Advisoriesby IbisStreamlitGHSA-8qw9-gf7w-42x5
Minor fix to previous patch for CVE-2022-35918
Fix: upgrade to 1.30.0 or later
Impact
The initial vulnerability identified in Streamlit apps using custom components, allowing for directory traversal attacks, was addressed in version 1.11.1. However, a minor issue persisted, which could still potentially expose certain files on the server file-system under specific conditions.
Patches
We released an update in version 1.30.0 to further tighten security measures. Users are strongly advised to update to version 1.30.0 immediately for optimal security.
Workarounds
No additional workarounds are necessary once the update to version 1.30.0 is applied.
For more information
If you have any questions or comments about this advisory:
- Email us at [security@streamlit.io](mailto:security@streamlit.io)
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| streamlit PyPI | >= 0.63.0, < 1.30.0 | 1.30.0 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-22
More Streamlit advisories
All Streamlit
Streamlit @st.cache_data hash collision via fixed sampling seed and PIL P-mode palette omissionCVE-2026-10804fixed in 1.53.1Unauthenticated SSRF Vulnerability in Streamlit on Windows (NTLM Credential Exposure)CVE-2026-33682fixed in 1.54.0Path traveral in Streamlit on windowsCVE-2024-42474fixed in 1.37.0Streamlit publishes previously-patched Cross-site Scripting vulnerabilityCVE-2023-27494fixed in 0.81.0Streamlit directory traversal vulnerabilityCVE-2022-35918fixed in 1.11.1