CVE-2026-48818 Details
Description
Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and earlier, StaticFiles on Windows is vulnerable to SSRF. An UNC path such as \\attacker.com\share can cause os.path.realpath to initiate an outbound SMB connection before the path is rejected, exposing the service account’s NTLMv2 credentials for offline cracking or relay even though the HTTP response is only a 404. The issue affects default follow_symlink=False deployments, including frameworks built on Starlette such as FastAPI; POSIX systems and follow_symlink=True are unaffected. The issue is fixed in 1.1.0.
A server-side request forgery (SSRF) vulnerability has been identified in Starlette's StaticFiles component, affecting versions through 1.0.1 on Windows systems. When a UNC path is processed, it can trigger an outbound SMB connection, inadvertently exposing the service account's NTLMv2 credentials. This occurs before the path is rejected, leading to potential offline cracking or relaying of the credentials. The vulnerability is present in the default configuration where symbolic links are not followed, and it also impacts frameworks built on Starlette, such as FastAPI. In contrast, POSIX systems and configurations that do follow symbolic links are not vulnerable.
Users can upgrade to Starlette version 1.1.0 or later, where this vulnerability has been fixed. Alternatively, on Windows, static files can be served through a dedicated web server like nginx or IIS, which avoids the issue. Blocking outbound SMB connections from the application host can also prevent credential disclosure.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | redhat-SADP |
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| encode starlette | < 1.1.0 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 4, 2026 | CVE Modified | [email protected] |
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 26, 2026 | Initial Analysis | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | New CVE Received | [email protected] |