CVE-2024-28423

CRITICAL

Feluelle Airflow-diagrams - Unrestricted File Upload

Title source: rule

Description

Airflow-Diagrams v2.1.0 was discovered to contain an arbitrary file upload vulnerability in the unsafe_load function at cli.py. This vulnerability allows attackers to execute arbitrary code via uploading a crafted YML file.

References (1)

Core 1

Core References

Broken Link

https://github.com/bayuncao/vul-cve-15

Scores

CVSS v3 9.8

EPSS 0.0011

EPSS Percentile 29.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-434

Status published

Products (1)

feluelle/airflow-diagrams 2.1.0

Published Mar 14, 2024

Tracked Since Feb 18, 2026