CVE-2023-30970

Gotham table and Forward App Path traversal

State: Published
Severity: 6.5 Medium
Published: Jan 29, 2024
Updated: May 29, 2025
Reserved: Apr 21, 2023

Description

Gotham Table service and Forward App were found to be vulnerable to a Path traversal issue allowing an authenticated user to read arbitrary files on the file system.

Scores

CVSS	Score	Vector	Source
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	Palantir

Weaknesses

CWE-36 The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize absolute path sequences such as "/abs/path" that can resolve to a location that is outside of that directory.

Affected Products

Product	Versions
com.palantir.gotham:blackbird-witchcraftPalantir	before 104.30231002.10Affected before 104.30231001.8Affected before 104.30230807.59Affected before 104.30230908.21Affected before 103.30230304.433Affected before 104.30230604.81Affected before 104.30231003.9Affected

References

https://palantir.safebase.us/?tcuUid=69be99ef-ad24-4339-9017-c8bf70789c72

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.