In Streamlit affected versions, users hosting Streamlit app(s) that use custom components are vulnerable to a directory traversal attack that could leak data from their web server file-system such as: server logs, world-readable files, and potentially other sensitive information. An attacker can craft a malicious URL with file paths and the streamlit server would process that URL and return the contents of that file. This issue has been resolved in version 1.11.1. Users are advised to upgrade. There are no known workarounds for this issue.

Affected versions of Streamlit are susceptible to a vulnerability where improper output neutralization for logs occurs. This specific issue arises if the function `upload_file_request_handler.py` triggers a 400 error that includes the `session_id` value.

Affected versions of the streamlit package are vulnerable to server-side request forgery (SSRF) due to unsafe path handling that permits UNC/absolute/traversal path inputs to reach filesystem resolution. In lib/streamlit/web/server/component_file_utils.py (and related component/static file handling), path validation occurred too late (after path resolution like os.path.realpath()), which on Windows can interpret attacker-controlled UNC paths and trigger unintended network access; this is fixed by adding centralized checks (e.g., path_security.py / is_unsafe_path_pattern() plus early HTTP-layer blocking) in fix commit 934d2f1 (PR #13733).
https://github.com/streamlit/streamlit/commit/934d2f1

Affected versions of the Streamlit package are vulnerable to Server-Side Request Forgery (SSRF) due to improper validation of attacker-supplied filesystem paths on Windows hosts. In vulnerable code paths, including ComponentRequestHandler, Streamlit resolves user-controlled paths with os.path.realpath() or Path.resolve() before sufficient validation, allowing a malicious UNC path such as \\attacker-controlled-host\share to trigger an outbound SMB connection from the server.

In Streamlit affected versions, users hosting Streamlit app(s) that use custom components are vulnerable to a directory traversal attack that could leak data from their web server file-system such as: server logs, world-readable files, and potentially other sensitive information. An attacker can craft a malicious URL with file paths and the streamlit server would process that URL and return the contents of that file. This issue has been resolved in version 1.11.1. Users are advised to upgrade. There are no known workarounds for this issue.

Affected versions of Streamlit are susceptible to a vulnerability where improper output neutralization for logs occurs. This specific issue arises if the function `upload_file_request_handler.py` triggers a 400 error that includes the `session_id` value.

Affected versions of the streamlit package are vulnerable to server-side request forgery (SSRF) due to unsafe path handling that permits UNC/absolute/traversal path inputs to reach filesystem resolution. In lib/streamlit/web/server/component_file_utils.py (and related component/static file handling), path validation occurred too late (after path resolution like os.path.realpath()), which on Windows can interpret attacker-controlled UNC paths and trigger unintended network access; this is fixed by adding centralized checks (e.g., path_security.py / is_unsafe_path_pattern() plus early HTTP-layer blocking) in fix commit 934d2f1 (PR #13733).
https://github.com/streamlit/streamlit/commit/934d2f1

Affected versions of the Streamlit package are vulnerable to Server-Side Request Forgery (SSRF) due to improper validation of attacker-supplied filesystem paths on Windows hosts. In vulnerable code paths, including ComponentRequestHandler, Streamlit resolves user-controlled paths with os.path.realpath() or Path.resolve() before sufficient validation, allowing a malicious UNC path such as \\attacker-controlled-host\share to trigger an outbound SMB connection from the server.

In Streamlit affected versions, users hosting Streamlit app(s) that use custom components are vulnerable to a directory traversal attack that could leak data from their web server file-system such as: server logs, world-readable files, and potentially other sensitive information. An attacker can craft a malicious URL with file paths and the streamlit server would process that URL and return the contents of that file. This issue has been resolved in version 1.11.1. Users are advised to upgrade. There are no known workarounds for this issue.

Affected versions of Streamlit are susceptible to a vulnerability where improper output neutralization for logs occurs. This specific issue arises if the function `upload_file_request_handler.py` triggers a 400 error that includes the `session_id` value.

Affected versions of the streamlit package are vulnerable to server-side request forgery (SSRF) due to unsafe path handling that permits UNC/absolute/traversal path inputs to reach filesystem resolution. In lib/streamlit/web/server/component_file_utils.py (and related component/static file handling), path validation occurred too late (after path resolution like os.path.realpath()), which on Windows can interpret attacker-controlled UNC paths and trigger unintended network access; this is fixed by adding centralized checks (e.g., path_security.py / is_unsafe_path_pattern() plus early HTTP-layer blocking) in fix commit 934d2f1 (PR #13733).
https://github.com/streamlit/streamlit/commit/934d2f1

Affected versions of the Streamlit package are vulnerable to Server-Side Request Forgery (SSRF) due to improper validation of attacker-supplied filesystem paths on Windows hosts. In vulnerable code paths, including ComponentRequestHandler, Streamlit resolves user-controlled paths with os.path.realpath() or Path.resolve() before sufficient validation, allowing a malicious UNC path such as \\attacker-controlled-host\share to trigger an outbound SMB connection from the server.

In Streamlit affected versions, users hosting Streamlit app(s) that use custom components are vulnerable to a directory traversal attack that could leak data from their web server file-system such as: server logs, world-readable files, and potentially other sensitive information. An attacker can craft a malicious URL with file paths and the streamlit server would process that URL and return the contents of that file. This issue has been resolved in version 1.11.1. Users are advised to upgrade. There are no known workarounds for this issue.

Affected versions of Streamlit are susceptible to a vulnerability where improper output neutralization for logs occurs. This specific issue arises if the function `upload_file_request_handler.py` triggers a 400 error that includes the `session_id` value.

Affected versions of the streamlit package are vulnerable to server-side request forgery (SSRF) due to unsafe path handling that permits UNC/absolute/traversal path inputs to reach filesystem resolution. In lib/streamlit/web/server/component_file_utils.py (and related component/static file handling), path validation occurred too late (after path resolution like os.path.realpath()), which on Windows can interpret attacker-controlled UNC paths and trigger unintended network access; this is fixed by adding centralized checks (e.g., path_security.py / is_unsafe_path_pattern() plus early HTTP-layer blocking) in fix commit 934d2f1 (PR #13733).
https://github.com/streamlit/streamlit/commit/934d2f1

Affected versions of the Streamlit package are vulnerable to Server-Side Request Forgery (SSRF) due to improper validation of attacker-supplied filesystem paths on Windows hosts. In vulnerable code paths, including ComponentRequestHandler, Streamlit resolves user-controlled paths with os.path.realpath() or Path.resolve() before sufficient validation, allowing a malicious UNC path such as \\attacker-controlled-host\share to trigger an outbound SMB connection from the server.

In Streamlit affected versions, users hosting Streamlit app(s) that use custom components are vulnerable to a directory traversal attack that could leak data from their web server file-system such as: server logs, world-readable files, and potentially other sensitive information. An attacker can craft a malicious URL with file paths and the streamlit server would process that URL and return the contents of that file. This issue has been resolved in version 1.11.1. Users are advised to upgrade. There are no known workarounds for this issue.

Affected versions of Streamlit are susceptible to a vulnerability where improper output neutralization for logs occurs. This specific issue arises if the function `upload_file_request_handler.py` triggers a 400 error that includes the `session_id` value.

Affected versions of the streamlit package are vulnerable to server-side request forgery (SSRF) due to unsafe path handling that permits UNC/absolute/traversal path inputs to reach filesystem resolution. In lib/streamlit/web/server/component_file_utils.py (and related component/static file handling), path validation occurred too late (after path resolution like os.path.realpath()), which on Windows can interpret attacker-controlled UNC paths and trigger unintended network access; this is fixed by adding centralized checks (e.g., path_security.py / is_unsafe_path_pattern() plus early HTTP-layer blocking) in fix commit 934d2f1 (PR #13733).
https://github.com/streamlit/streamlit/commit/934d2f1

Affected versions of the Streamlit package are vulnerable to Server-Side Request Forgery (SSRF) due to improper validation of attacker-supplied filesystem paths on Windows hosts. In vulnerable code paths, including ComponentRequestHandler, Streamlit resolves user-controlled paths with os.path.realpath() or Path.resolve() before sufficient validation, allowing a malicious UNC path such as \\attacker-controlled-host\share to trigger an outbound SMB connection from the server.

In Streamlit affected versions, users hosting Streamlit app(s) that use custom components are vulnerable to a directory traversal attack that could leak data from their web server file-system such as: server logs, world-readable files, and potentially other sensitive information. An attacker can craft a malicious URL with file paths and the streamlit server would process that URL and return the contents of that file. This issue has been resolved in version 1.11.1. Users are advised to upgrade. There are no known workarounds for this issue.

Affected versions of Streamlit are susceptible to a vulnerability where improper output neutralization for logs occurs. This specific issue arises if the function `upload_file_request_handler.py` triggers a 400 error that includes the `session_id` value.

Affected versions of the streamlit package are vulnerable to server-side request forgery (SSRF) due to unsafe path handling that permits UNC/absolute/traversal path inputs to reach filesystem resolution. In lib/streamlit/web/server/component_file_utils.py (and related component/static file handling), path validation occurred too late (after path resolution like os.path.realpath()), which on Windows can interpret attacker-controlled UNC paths and trigger unintended network access; this is fixed by adding centralized checks (e.g., path_security.py / is_unsafe_path_pattern() plus early HTTP-layer blocking) in fix commit 934d2f1 (PR #13733).
https://github.com/streamlit/streamlit/commit/934d2f1

Affected versions of the Streamlit package are vulnerable to Server-Side Request Forgery (SSRF) due to improper validation of attacker-supplied filesystem paths on Windows hosts. In vulnerable code paths, including ComponentRequestHandler, Streamlit resolves user-controlled paths with os.path.realpath() or Path.resolve() before sufficient validation, allowing a malicious UNC path such as \\attacker-controlled-host\share to trigger an outbound SMB connection from the server.

In Streamlit affected versions, users hosting Streamlit app(s) that use custom components are vulnerable to a directory traversal attack that could leak data from their web server file-system such as: server logs, world-readable files, and potentially other sensitive information. An attacker can craft a malicious URL with file paths and the streamlit server would process that URL and return the contents of that file. This issue has been resolved in version 1.11.1. Users are advised to upgrade. There are no known workarounds for this issue.

Affected versions of Streamlit are susceptible to a vulnerability where improper output neutralization for logs occurs. This specific issue arises if the function `upload_file_request_handler.py` triggers a 400 error that includes the `session_id` value.

Affected versions of the streamlit package are vulnerable to server-side request forgery (SSRF) due to unsafe path handling that permits UNC/absolute/traversal path inputs to reach filesystem resolution. In lib/streamlit/web/server/component_file_utils.py (and related component/static file handling), path validation occurred too late (after path resolution like os.path.realpath()), which on Windows can interpret attacker-controlled UNC paths and trigger unintended network access; this is fixed by adding centralized checks (e.g., path_security.py / is_unsafe_path_pattern() plus early HTTP-layer blocking) in fix commit 934d2f1 (PR #13733).
https://github.com/streamlit/streamlit/commit/934d2f1

Affected versions of the Streamlit package are vulnerable to Server-Side Request Forgery (SSRF) due to improper validation of attacker-supplied filesystem paths on Windows hosts. In vulnerable code paths, including ComponentRequestHandler, Streamlit resolves user-controlled paths with os.path.realpath() or Path.resolve() before sufficient validation, allowing a malicious UNC path such as \\attacker-controlled-host\share to trigger an outbound SMB connection from the server.

In Streamlit affected versions, users hosting Streamlit app(s) that use custom components are vulnerable to a directory traversal attack that could leak data from their web server file-system such as: server logs, world-readable files, and potentially other sensitive information. An attacker can craft a malicious URL with file paths and the streamlit server would process that URL and return the contents of that file. This issue has been resolved in version 1.11.1. Users are advised to upgrade. There are no known workarounds for this issue.

Affected versions of Streamlit are susceptible to a vulnerability where improper output neutralization for logs occurs. This specific issue arises if the function `upload_file_request_handler.py` triggers a 400 error that includes the `session_id` value.

Affected versions of the streamlit package are vulnerable to server-side request forgery (SSRF) due to unsafe path handling that permits UNC/absolute/traversal path inputs to reach filesystem resolution. In lib/streamlit/web/server/component_file_utils.py (and related component/static file handling), path validation occurred too late (after path resolution like os.path.realpath()), which on Windows can interpret attacker-controlled UNC paths and trigger unintended network access; this is fixed by adding centralized checks (e.g., path_security.py / is_unsafe_path_pattern() plus early HTTP-layer blocking) in fix commit 934d2f1 (PR #13733).
https://github.com/streamlit/streamlit/commit/934d2f1

Affected versions of the Streamlit package are vulnerable to Server-Side Request Forgery (SSRF) due to improper validation of attacker-supplied filesystem paths on Windows hosts. In vulnerable code paths, including ComponentRequestHandler, Streamlit resolves user-controlled paths with os.path.realpath() or Path.resolve() before sufficient validation, allowing a malicious UNC path such as \\attacker-controlled-host\share to trigger an outbound SMB connection from the server.