Minor fix to previous patch for CVE-2022-35918
Medium5.3Published Jan 12, 2024 · updated Jun 30, 2026
### Impact The initial vulnerability identified in Streamlit apps using custom components, allowing for directory traversal attacks, was addressed in version 1.11.1. However, a minor issue persisted, which could still potentially expose certain files on the server file-system under specific conditions. ### Patches We released an update in version 1.30.0 to further tighten security measures. Users are strongly advised to update to version 1.30.0 immediately for optimal security. ### Workarounds No additional workarounds are necessary once the update to version 1.30.0 is applied. ### For more information If you have any questions or comments about this advisory: * Email us at [security@streamlit.io](mailto:security@streamlit.io)
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| streamlit PyPI | >= 0.63.0, < 1.30.0 | 1.30.0 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-22
More Streamlit advisories
All Streamlit| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jun 4 | Streamlit @st.cache_data hash collision via fixed sampling seed and PIL P-mode palette omission Low3.6Jun 4 | Low3.6 | 1.53.1 |
| Mar 25 | Unauthenticated SSRF Vulnerability in Streamlit on Windows (NTLM Credential Exposure)Medium4.7Mar 25 | Medium4.7 | 1.54.0 |
| Aug 122024 | Path traveral in Streamlit on windowsMedium5.9Aug 12, 2024 | Medium5.9 | 1.37.0 |
| Mar 172023 | Streamlit publishes previously-patched Cross-site Scripting vulnerabilityMedium5.9Mar 17, 2023 | Medium5.9 | 0.81.0 |
| Aug 62022 | Streamlit directory traversal vulnerabilityMedium6.5Aug 6, 2022 | Medium6.5 | 1.11.1 |