CVE-2026-34783 Details
Description
Ferret is a declarative system for working with web data. Prior to 2.0.0-alpha.4, a path traversal vulnerability in Ferret's IO::FS::WRITE standard library function allows a malicious website to write arbitrary files to the filesystem of the machine running Ferret. When an operator scrapes a website that returns filenames containing ../ sequences, and uses those filenames to construct output paths (a standard scraping pattern), the attacker controls both the destination path and the file content. This can lead to remote code execution via cron jobs, SSH authorized_keys, shell profiles, or web shells. This vulnerability is fixed in 2.0.0-alpha.4.
A path traversal vulnerability has been identified in Ferret versions prior to 2.0.0-alpha.4. The issue resides in the IO::FS::WRITE standard library function, where user-supplied file paths are passed directly to the file system without proper sanitization. This vulnerability allows a malicious website to manipulate file paths and write arbitrary files to the filesystem of the machine running Ferret. Exploitation occurs when an operator scrapes a website that returns filenames with '../' sequences, using those names to construct output paths—a common scraping practice. The attacker can control both the destination path and the content of the files being written. This flaw could lead to remote code execution by overwriting cron jobs, SSH authorized_keys, shell profiles, or by placing web shells on the server.
Users are advised to update to Ferret version 2.0.0-alpha.4 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/MontFerret/ferret/security/advisories/GHSA-j6v5-g24h-vg4j | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/MontFerret/ferret/commit/160ebad6bd50f153453e120f6d909f5b83322917 | [email protected] | Patch |
| https://github.com/MontFerret/ferret/security/advisories/GHSA-j6v5-g24h-vg4j | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
| CWE-73 | External Control of File Name or Path | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| montferret ferret | < 2.0.0 2.0.0 alpha1 2.0.0 alpha2 2.0.0 alpha3 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 14, 2026 | Initial Analysis | [email protected] |
| Apr 7, 2026 | CVE Modified | CISA-ADP |
| Apr 6, 2026 | New CVE Received | [email protected] |