PT-2024-22426 · Unknown · Airflow-Diagrams
CVE-2024-28423
·
Published
2024-03-14
·
Updated
2025-09-18
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Airflow-Diagrams version 2.1.0
Description
The issue is related to an arbitrary file upload vulnerability in the
unsafe load function at cli.py. This allows attackers to execute arbitrary code via uploading a crafted YML file.Recommendations
For Airflow-Diagrams version 2.1.0, consider disabling the
unsafe load function at cli.py until a patch is available to prevent the execution of arbitrary code. Restrict access to uploading files, especially YML files, to minimize the risk of exploitation.Exploit
Fix
Unrestricted File Upload
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Airflow-Diagrams