Arbitrary file read un Vapor
Priority MEDIUM 40CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
Vapor is a web framework for Swift. In Vapor before version 4.29.4, Attackers can access data at arbitrary filesystem paths on the same host as an application. Only applications using FileMiddleware are affected. This is fixed in version 4.29.4.
Why it matters now
EPSS 0.0153 74th percentileScored 2026-11-07
Fix Fixed vapor (vapor): 4.29.4github.com/vapor/vapor (SwiftURL): 4.29.4
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| vapor | vapor | before 4.29.4 | 4.29.4 | Patch available | CNA |
| — | github.com/vapor/vapor (SwiftURL) | 4.0.0-rc.2.5 to before 4.29.4 | 4.29.4 | Patch available | GHSA-vcvg-xgr8-p5gq |
- vapor Vendorvapor Affected before 4.29.4 Fixed in 4.29.4 Patch available CNA
- github.com/vapor/vapor (SwiftURL) Vendor— Affected 4.0.0-rc.2.5 to before 4.29.4 Fixed in 4.29.4 Patch available GHSA-vcvg-xgr8-p5gq
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:vapor_project:vapor:*:*:*:*:*:swift:*:* | before 4.29.4 | Vulnerable | Vapor Project |
- cpe:2.3:a:vapor_project:vapor:*:*:*:*:*:swift:*:* Versions before 4.29.4 Vulnerable ·Vapor Project
Remediation
- Fix · CNA vapor (vapor) Fixed in 4.29.4
- Fix · GHSA-vcvg-xgr8-p5gq github.com/vapor/vapor (SwiftURL) Fixed in 4.29.4 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2020-15230
- 2026-10-03 Alias added: GHSA-vcvg-xgr8-p5gq
References
More vapor vulnerabilities
- TI-2022-13064 DoS Vulnerability in URLEncodedFormDecoder in Vapor CVSS 3.1HIGH 7.5
- TI-2022-13051 Integer Overflow in Vapor's HTTP Range Request CVSS 3.1HIGH 7.5
- TI-2026-22762 LeafKit's HTML escaping may be skipped for Collection values, enabling XSS CVSS 4.0MEDIUM 6.9
- TI-2026-21572 Leaf-kit html escaping does not work on characters that are part of extended grapheme cluster CVSS 3.1MEDIUM 6.1
- TI-2021-12410 Untrusted data fed into `Data.init(base32Encoded:)` can result in exposing server memory and/or crash CVSS 3.1CRITICAL 9.1
- TI-2024-14356 Integer overflow in URI leading to potential host spoofing CVSS 3.1MEDIUM 6.5
Sources
- CVE-2020-15230 · CVE Program
- CVE-2020-15230 · NVD
- FIRST EPSS
- GHSA-vcvg-xgr8-p5gq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences