Bazarr Arbitrary file read in /api/swaggerui/static endpoint

CVE-2023-50265

What is CVE-2023-50265?

An arbitrary file read vulnerability has been discovered in Bazarr, a tool for managing and downloading subtitles. This flaw exists in the /api/swaggerui/static endpoint of bazarr/app/ui.py, where the application fails to validate the user-controlled filename variable before using it in the send_file function. This oversight allows unauthorized users to potentially access sensitive files on the system. The issue has been effectively resolved in Bazarr version 1.3.1, emphasizing the importance of updating to this version or later to protect against this security threat.

References