CVE-2026-48818

Name of the Vulnerable Software and Affected Versions Starlette versions prior to 1.1.0

Description On Windows, the StaticFiles component is susceptible to Server-Side Request Forgery (SSRF). When a request containing a Universal Naming Convention (UNC) path, such as attacker.comshare, is processed, the lookup path() function utilizes os.path.realpath() to resolve the path. Because UNC paths are treated as absolute on Windows, the system initiates an outbound SMB connection to the remote host over port 445 to resolve the path before it is rejected. This process leaks the service account's NTLMv2 credentials to the attacker-controlled host, which can then be used for offline cracking or relay attacks. This issue affects default deployments where follow symlink is set to False, including frameworks built on Starlette such as FastAPI. POSIX systems and configurations where follow symlink is set to True are not affected. The credential disclosure occurs even if the server ultimately returns a 404 HTTP response.

Recommendations Update to version 1.1.0. On Windows, serve static files through a dedicated web server such as nginx or IIS instead of using StaticFiles. Block outbound SMB traffic on port 445 from the application host to prevent credential disclosure.