CVE-2023-6020
High · 7.5CVSS
7.5
EPSS
14.7%
Published
Nov 16, 2023
CISA due date
—
The record
LFI in Ray's /static/ directory allows attackers to read any file on the server without authentication.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | ray | 0 | No fix |
| PyPI | ray | 0 | 2.8.1 |
Related vulnerabilities
- CVE-2026-27482 Ray is an AI compute engine. Also affects ray
- GHSA-q5fh-2hc8-f6rq Ray dashboard DELETE endpoints allow unauthenticated browser-triggered DoS (Serve… Also affects ray
- CVE-2025-34351 Ray's New Token Authentication is Disabled By Default Also affects ray
- CVE-2025-62593 Ray is an AI compute engine. Also affects ray
- CVE-2023-6021 LFI in Ray's log API endpoint allows attackers to read any file on the server without… Also affects ray
- CVE-2023-6019 A command injection existed in Ray's cpu_profile URL parameter allowing attackers to… Also affects ray
- CVE-2026-96391 Missing Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. CWE-862
- CVE-2026-96380 Missing Authorization vulnerability in Drupal CSS Usage Analyzer allows Forceful Browsing. CWE-862