CRITICAL9.3
PYSEC-2026-436
SatyaLab opendiamond 10.1.1 vulnerable to path traversal because Flask send_file function used unsafely
Details
The cmusatyalab/opendiamond repository through 10.1.1 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. A patch is available on the `master` branch of the repository.
Are you affected?
Enter the version of the package you're using.
Affected packages
PyPI/opendiamond
Introduced in:
0No fixed version published yet for opendiamond (pip). Pin to a known-safe version or switch to an alternative.
References
- https://nvd.nist.gov/vuln/detail/CVE-2022-31506[ADVISORY]
- https://github.com/cmusatyalab/opendiamond/issues/52[WEB]
- https://github.com/github/securitylab/issues/669#issuecomment-1117265726[WEB]
- https://github.com/cmusatyalab/opendiamond/commit/398049c187ee644beabab44d6fece82251c1ea56[WEB]
- https://github.com/cmusatyalab/opendiamond[PACKAGE]
- https://pypi.org/project/opendiamond[PACKAGE]
- https://github.com/advisories/GHSA-x2pc-fqrw-hc7f[ADVISORY]