PT-2026-29811 · Ferret · Ferret

Davidcarliez · Published 2026-04-01 · Updated 2026-04-06 · CVE-2026-34783

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Ferret versions prior to 2.0.0-alpha.4

Description: Ferret is a declarative system for working with web data. A path traversal vulnerability exists in the IO::FS::WRITE standard library function, allowing a malicious website to write arbitrary files to the filesystem of the machine running Ferret. This occurs when an operator scrapes a website that returns filenames containing '../' sequences, and uses those filenames to construct output paths. An attacker can control both the destination path and the file content, potentially leading to remote code execution via cron jobs, SSH authorized keys, shell profiles, or web shells. The vulnerability is due to the lack of path sanitization in the IO::FS::WRITE function, which directly passes user-supplied file paths to os.OpenFile without canonicalization, base directory enforcement, or traversal sequence rejection. The API endpoint used in the attack is 'http://evil.com/api/articles', which returns a JSON payload containing filenames with path traversal sequences. The vulnerable parameter is the 'name' field within the JSON data, which is used to construct the output path. The function IO::FS::WRITE is directly involved in the vulnerability. The attacker can target paths like '/etc/cron.d/' for command execution, '~/.ssh/authorized keys' for SSH access, and application config files for credential theft.

Recommendations: Update to Ferret version 2.0.0-alpha.4 or later. As a temporary workaround, reject path traversal in IO::FS::WRITE and IO::FS::READ by resolving the path and verifying it doesn't contain '..' after cleaning. Alternatively, implement base directory enforcement to jail FS operations to a specific directory.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

CWE-73

Related Identifiers

CVE-2026-34783

GHSA-J6V5-G24H-VG4J

Affected Products

Ferret

References · 6

• 🔥 https://github.com/MontFerret/ferret/security/advisories/GHSA-j6v5-g24h-vg4j · Exploit
• https://github.com/MontFerret/ferret/commit/160ebad6bd50f153453e120f6d909f5b83322917 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-34783 · Security Note
• https://osv.dev/vulnerability/GHSA-j6v5-g24h-vg4j · Vendor Advisory
• https://github.com/MontFerret/ferret · Note
• https://twitter.com/CVEnew/status/2041223983861731341 · Twitter Post