PT-2025-30442 · Dagster · Dagster

Geckosecurity · Published 2025-07-22 · Updated 2025-07-22 · CVE-2025-51481

Positive Technologies (AI Summary)

CVSS v3.1

6.6

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions Dagster version 1.10.14

Description A local file inclusion issue exists in the dagster. grpc.impl.get notebook data function. Attackers with access to the gRPC server can read arbitrary files by providing path traversal sequences in the notebook path field of ExternalNotebookData requests, bypassing the intended extension-based check.

Recommendations Update to a newer version that contains a fix for this issue. As a temporary workaround, restrict access to the gRPC server to minimize the risk of exploitation.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-51481

GHSA-H7X8-JV97-FVVM

PYSEC-2025-102

Affected Products

Dagster

References · 14

• 🔥 https://gecko.security/blog/cve-2025-51481 · Exploit
• https://github.com/dagster-io/dagster/pull/30002 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h7x8-jv97-fvvm · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2025-102 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-51481 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-51481 · Security Note
• https://github.com/dagster-io/dagster · Note
• https://github.com/dagster-io/dagster/commit/3a3cec2b51577c4970e6fc4c199cda6418c09a9d · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/dagster-ge/PYSEC-2025-102.yaml · Note
• https://t.me/cveNotify/129879 · Telegram Post
• https://twitter.com/CVEnew/status/1947707752987377726 · Twitter Post
• https://t.me/cvetracker/28397 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1947724908059922652 · Twitter Post
• https://t.me/CVEtracker/28397 · Telegram Post