CVE-2023-3348

Directory traversal vulnerability in Cloudflare Wrangler

State: Published
Severity: 5.7 Medium
Published: Aug 3, 2023
Updated: Oct 9, 2024
Reserved: Jun 21, 2023

Description

The Wrangler command line tool (<=wrangler@3.1.0 or <=wrangler@2.20.1) was affected by a directory traversal vulnerability when running a local development server for Pages (wrangler pages dev command). This vulnerability enabled an attacker in the same network as the victim to connect to the local development server and access the victim's files present outside of the directory for the development server.

Scores

CVSS	Score	Vector	Source
3.1	5.7 Medium	CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N	cloudflare

Weaknesses

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected Products

Product	Versions
WranglerCloudflare	3 to before 3.1.1Affectedfrom 3.1.1Not affected 2 to before 2.20.1Affectedfrom 2.20.1Not affected

References

https://github.com/cloudflare/workers-sdk/security/advisories/GHSA-8c93-4hch-xgxpvendor-advisory
https://github.com/cloudflare/workers-sdkproduct
https://developers.cloudflare.com/workers/wrangler/related

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.