CVE-2018-12563

Severity: medium (CVSS 6.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-06-19 · updated 2026-06-17
Weakness: CWE-20

Description

An issue was discovered in Linaro LAVA before 2018.5.post1. Because of support for file: URLs, a user can force lava-server-gunicorn to download any file from the filesystem if it's readable by lavaserver and valid yaml.

Affected products

Linaro Lava: before 2018.5.post1 — fixed in 2018.5.post1

How to fix

Upgrade to a fixed version: Linaro Lava 2018.5.post1. Check the vendor advisory for mitigations.

References

https://git.linaro.org/lava/lava.git/commit/?id=e24ec39599bc07562ad8bc2a581144b8448cb214
https://git.linaro.org/lava/lava.git/commit/?id=e24ec39599bc07562ad8bc2a581144b8448cb214

Get alerted when CVE-2018-12563 or the next vulnerability affects your stack