ray-project · ray-project/ray
A local file inclusion (path traversal) flaw in the /static/ directory of the Ray project's ray-project/ray product allows attackers to read arbitrary files on the server. The attack requires only network access, with no authentication or user interaction, and the flaw stems from missing authorization checks.
LFI in Ray's /static/ directory allows attackers to read any file on the server without authentication.
Public exploit code (Metasploit) was available 1 day before disclosure.
No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
1 package in 1 ecosystem. Main package: ray.
Upgrade to 2.52.0 or later
Fixes this CVE and 4 other known vulnerabilities in this package (CVE-2023-48022, CVE-2023-6019, +2).
pip install "ray>=2.52.0"First fixed in 2.8.1 for CVE-2023-6020.
| If you run | Upgrade to |
|---|---|
| All versions before 2.8.1 | 2.52.0first fix for this CVE: 2.8.1 |
“Up to” means the second version is the fix and is not affected.
Reports are matched by finding the exact id CVE-2023-6020 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
Mentions the CVE; no further detail.