Path Traversal Vulnerability in Ferret's IO::FS::WRITE Function

CVE-2026-34783

What is CVE-2026-34783?

A path traversal vulnerability exists in the IO::FS::WRITE function of Ferret, a declarative web data processing system. This flaw allows attackers to exploit filenames containing traversal sequences (../) while scraping web data. Consequently, this manipulation can lead to the construction of arbitrary output paths, giving attackers control over both the destination and content of files written to the filesystem. The implications of this vulnerability are severe, potentially enabling remote code execution through malicious cron jobs, SSH authorized_keys configurations, shell profiles, or the insertion of web shells. The issue has been addressed in version 2.0.0-alpha.4.

References