What’s Vulnerable › Vulnerabilities

CVE-2023-6020: Ray Static File Local File Include

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 14.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-11-16 · updated 2026-06-17
• Weakness: CWE-862

Description

LFI in Ray's /static/ directory allows attackers to read any file on the server without authentication.

Affected products

• ray-project/ray: all versions

References

• https://huntr.com/bounties/83dd8619-6dc3-4c98-8f1b-e620fedcd1f6
• https://huntr.com/bounties/83dd8619-6dc3-4c98-8f1b-e620fedcd1f6

Get alerted when CVE-2023-6020 or the next vulnerability affects your stack