Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Ferret is a declarative system for working with web data. Prior to 2.0.0-alpha.4, a path traversal vulnerability in Ferret's IO::FS::WRITE standard library function allows a malicious website to write arbitrary files to the filesystem of the machine running Ferret. When an operator scrapes a website that returns filenames containing ../ sequences, and uses those filenames to construct output paths (a standard scraping pattern), the attacker controls both the destination path and the file content. This can lead to remote code execution via cron jobs, SSH authorized_keys, shell profiles, or web shells. This vulnerability is fixed in 2.0.0-alpha.4.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
🔓 CVE-2026-34783: Ferret path traversal in IO::FS::WRITE for arbitrary writes. Severity: High. Published: 2026-04-03. Source: https://www.tenable.com/cve/newest
Post summary
A newly disclosed high‑severity vulnerability, CVE‑2026‑34783, is a path‑traversal flaw in Ferret’s IO::FS::WRITE module that allows arbitrary writes.
CVE-2026-34783 Ferret is a declarative system for working with web data. Prior to 2.0.0-alpha.4, a path traversal vulnerability in Ferret's IO::FS::WRITE standard library function a… https://www.cve.org/CVERecord?id=CVE-2026-34783
Post summary
The post discloses a path traversal vulnerability affecting Ferret’s IO::FS::WRITE function before version 2.0.0‑alpha.4, but does not provide PoC, exploit code, or patch details.
4 of 4 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | montferret | ferret | - | go | - |
| App | montferret | ferret | 2.0.0 | go | - |
| App | montferret | ferret | 2.0.0 | go | - |
| App | montferret | ferret | 2.0.0 | go | - |