Bazarr Arbitrary file read in /system/backup/download/ endpoint

CVE-2023-50264

What is CVE-2023-50264?

Bazarr, a subtitle management tool, has a vulnerability where it allows an arbitrary file read due to insufficient validation of user-controlled filenames in the /system/backup/download/ endpoint. This flaw resides in the app/ui.py file, specifically within the send_file function. If exploited, this vulnerability could enable unauthorized access to sensitive files on the server. Users are advised to update to version 1.3.1 or later, where this issue has been addressed.

References