CVE-2023-38337

—

CVSS 3.1

7.5 high

EPSS

1%p68

Published

Jul 14, 2023 (Jul 14, 2023)

Modified

Jun 17, 2026

Description

rswag before 2.10.1 allows remote attackers to read arbitrary JSON and YAML files via directory traversal, because rswag-api can expose a file that is not the OpenAPI (or Swagger) specification file of a project.

Vendors: rswag project
Products: rswag
Weakness: CWE-22
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (1.3%)

In the news0 stories

No ingested article mentions this CVE yet.