CVE-2024-32982

Litestar and Starlite is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to 2.8.3, 2.7.2, and 2.6.4, a Local File Inclusion (LFI) vulnerability has been discovered in the static file serving component of LiteStar. This vulnerability allows attackers to exploit path traversal flaws, enabling unauthorized access to sensitive files outside the designated directories. Such access can lead to the disclosure of sensitive information or potentially compromise the server. The vulnerability is located in the file path handling mechanism within the static content serving function, specifically at `litestar/static_files/base.py`. This vulnerability is fixed in versions 2.8.3, 2.7.2, and 2.6.4.

• CWE-22

• https://github.com/litestar-org/litestar/blob/main/litestar/static_files/base.py#L70
• https://github.com/litestar-org/litestar/commit/57e706e7effdc182fc9a2af5981bc88afb21851b
• https://github.com/litestar-org/litestar/security/advisories/GHSA-83pv-qr33-2vcf
• https://github.com/litestar-org/litestar/blob/main/litestar/static_files/base.py#L70
• https://github.com/litestar-org/litestar/commit/57e706e7effdc182fc9a2af5981bc88afb21851b
• https://github.com/litestar-org/litestar/security/advisories/GHSA-83pv-qr33-2vcf

Published

May 6, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-32977OctoPrint provides a web interface for controlling consumer …9.4
• CVE-2024-32978Kaminari is a paginator for web app frameworks and object re…6.6
• CVE-2024-32979Nautobot is a Network Source of Truth and Network Automation…6.1
• CVE-2024-3298Out-Of-Bounds Write and Type Confusion vulnerabilities exist…7.8
• CVE-2024-32980Spin is the developer tool for building and running serverle…9.1
• CVE-2024-32981Silverstripe framework is the PHP framework forming the base…5.4
• CVE-2024-32983Misskey is an open source, decentralized microblogging platf…7.5
• CVE-2024-32984Yamux is a stream multiplexer over reliable, ordered connect…7.5
• CVE-2024-32985Stellar-core is a reference implementation for the peer-to-p…5.9
• CVE-2024-32986PWAsForFirefox is a tool to install, manage and use Progress…9.6
• CVE-2024-32987Microsoft SharePoint Server Information Disclosure Vulnerabi…7.5
• CVE-2024-32988'OfferBox' App for Android versions 2.0.0 to 2.3.17 and 'Off…7.5