AI and data stack advisories

Severe, 6 weeks1498Projects326

1498 severe, 6 weeks · 326 projects

RayGHSA-3pww-qvr8-6mhp

Ray Path Traversal vulnerability

Ray

CVE-2023-6021 · Published Nov 16, 2023 · updated Sep 10, 2026

Critical9.3
Fix: upgrade to 2.8.1 or later
GitHub advisory

LFI in Ray's log API endpoint allows attackers to read any file on the server without authentication. The issue is fixed in version 2.8.1+. Ray maintainers response can be found here: https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023

Affected versions

PackageAffectedFixed in
ray
PyPI
< 2.8.12.8.1
Details and references
CVSS 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-22, CWE-29
Also known as
CVE-2023-6021, PYSEC-2026-515

More Ray advisories

All Ray
CriticalNov 27, 2025Ray's New Token Authentication is Disabled By DefaultCVE-2025-34351no fix yetCriticalNov 26, 2025Ray is vulnerable to Critical RCE via Safari & Firefox Browsers through DNS Rebinding AttackCVE-2025-62593fixed in 2.52.0Medium 6.4Mar 6, 2025ray vulnerable to Insertion of Sensitive Information into Log FileCVE-2025-1979fixed in 2.43.0Critical 9.8Nov 28, 2023Ray has arbitrary code execution via jobs submission APICVE-2023-48022no fix yetCritical 9.3Nov 16, 2023Ray Missing Authorization vulnerabilityCVE-2023-6020fixed in 2.8.1Critical 9.8Nov 16, 2023Ray OS Command Injection vulnerabilityCVE-2023-6019fixed in 2.8.1