CVE-2023-7079: Arbitrary remote file read in Wrangler dev server

Severity: medium (CVSS 5.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-12-29 · updated 2026-06-17
Weakness: CWE-287

Description

Sending specially crafted HTTP requests and inspector messages to Wrangler's dev server could result in any file on the user's computer being accessible over the local network. An attacker that could trick any user on the local network into opening a malicious website could also read any file.

Affected products

Cloudflare Wrangler: from 3.9.0 before 3.19.0 — fixed in 3.19.0

How to fix

Upgrade to a fixed version: Cloudflare Wrangler 3.19.0. Check the vendor advisory for mitigations.

References

https://github.com/cloudflare/workers-sdk/pull/4532
https://github.com/cloudflare/workers-sdk/pull/4535
https://github.com/cloudflare/workers-sdk/security/advisories/GHSA-cfph-4qqh-w828
https://github.com/cloudflare/workers-sdk/pull/4532
https://github.com/cloudflare/workers-sdk/pull/4535
https://github.com/cloudflare/workers-sdk/security/advisories/GHSA-cfph-4qqh-w828

Get alerted when CVE-2023-7079 or the next vulnerability affects your stack