CVE-2023-6021
High · 7.5CVSS
7.5
EPSS
37.1%
Published
Nov 16, 2023
CISA due date
—
The record
LFI in Ray's log API endpoint allows attackers to read any file on the server without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here: https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | ray | 0 | No fix |
| PyPI | ray | 0 | 2.8.1 |
Related vulnerabilities
- CVE-2026-27482 Ray is an AI compute engine. Also affects ray
- GHSA-q5fh-2hc8-f6rq Ray dashboard DELETE endpoints allow unauthenticated browser-triggered DoS (Serve… Also affects ray
- CVE-2025-34351 Ray's New Token Authentication is Disabled By Default Also affects ray
- CVE-2025-62593 Ray is an AI compute engine. Also affects ray
- CVE-2023-6020 LFI in Ray's /static/ directory allows attackers to read any file on the server without… Also affects ray
- CVE-2023-6019 A command injection existed in Ray's cpu_profile URL parameter allowing attackers to… Also affects ray
- CVE-2026-81163 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')… CWE-22
- CVE-2026-112049 Vita3K before build 4187 contains a path traversal (zip slip) vulnerability in… CWE-22