CVE-2020-37041

Summary

OpenCTI 3.3.1 is vulnerable to a directory traversal attack via the static/css endpoint. An unauthenticated attacker can read arbitrary files from the filesystem by sending crafted GET requests with path traversal sequences (e.g., '../') in the URL. For example, requesting /static/css//../../../../.

Severity

high

EPSS

1.0% (p58)

Also known as

PYSEC-2026-114

Published

2026-01-30

References

• https://www.opencti.io/
• https://www.vulncheck.com/advisories/opencti-directory-traversal
• https://github.com/OpenCTI-Platform/opencti

Related advisories

• CVE-2026-27960 — critical · PyPI/pycti
• CVE-2025-61781 — critical · PyPI/pycti
• CVE-2025-24977 — critical · PyPI/pycti
• CVE-2026-44730 — high · PyPI/pycti
• CVE-2026-21886 — high · PyPI/pycti
• CVE-2026-21887 — high · PyPI/pycti
• CVE-2024-45404 — high · PyPI/pycti
• CVE-2026-35212 — medium · PyPI/pycti

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity