Read the docs
TI-2023-00275 Aliases CVE-2023-0290GHSA-7jf5-fvgf-48c6

Rapid7 Velociraptor directory traversal in client ID parameter

Priority LOW 21CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-22 and the CVSS impact.

Summary

Rapid7 Velociraptor did not properly sanitize the client ID parameter to the CreateCollection API, allowing a directory traversal in where the collection task could be written. It was possible to provide a client id of "../clients/server" to schedule the collection for the server (as a server artifact), but only require privileges to schedule collections on the client. Normally, to schedule an artifact on the server, the COLLECT_SERVER permission is required. This permission is normally only granted to "administrator" role. Due to this issue, it is sufficient to have the COLLECT_CLIENT privilege, which is normally granted to the "investigator" role. To exploit this vulnerability, the attacker must already have a Velociraptor user account at least "investigator" level, and be able to authenticate to the GUI and issue an API call to the backend. Typically, most users deploy Velociraptor with limited access to a trusted group, and most users will already be administrators within the GUI. This issue affects Velociraptor versions before 0.6.7-5. Version 0.6.7-5, released January 16, 2023, fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00765 55th percentileScored 2026-11-07
Fix Fixed Velociraptor (Rapid7): 0.6.7-5www.velocidex.com/golang/velociraptor (Go): 0.6.7-5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Rapid7Velociraptorbefore 0.6.7-50.6.7-5Patch availableCNA
—www.velocidex.com/golang/velociraptor (Go)before 0.6.7-50.6.7-5Patch availableGHSA-7jf5-fvgf-48c6
  • Velociraptor VendorRapid7 Affected before 0.6.7-5 Fixed in 0.6.7-5 Patch available CNA
  • www.velocidex.com/golang/velociraptor (Go) Vendor— Affected before 0.6.7-5 Fixed in 0.6.7-5 Patch available GHSA-7jf5-fvgf-48c6

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:rapid7:velociraptor:*:*:*:*:*:*:*:*before 0.6.7-5VulnerableRapid7
  • cpe:2.3:a:rapid7:velociraptor:*:*:*:*:*:*:*:* Versions before 0.6.7-5 Vulnerable ·Rapid7

Remediation

  • Fix · CNA Velociraptor (Rapid7) Fixed in 0.6.7-5
  • Fix · GHSA-7jf5-fvgf-48c6 www.velocidex.com/golang/velociraptor (Go) Fixed in 0.6.7-5 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Rapid7 Velociraptor 0.6.7-5

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2023-00229 Insufficient permission check in the VQL copy() functionPriority LOW 39
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-0290
  2. 2026-10-03 Alias added: GHSA-7jf5-fvgf-48c6

References

Advisory 2

Other 2

  • TI-2023-05481 Rapid7 Velociraptor Reflected XSS CVSS 3.1HIGH 8.6
  • TI-2026-05514 Velociraptor Query() Plugin Misapplies Permissions To Orgs CVSS 3.1CRITICAL 9.1
  • TI-2026-04661 Rapid7 Velociraptor Improper Input Validation in Client Message Handler CVSS 3.1HIGH 8.5
  • TI-2023-00229 Insufficient permission check in the VQL copy() function CVSS 3.1HIGH 8.8
  • TI-2026-06659 GetUserRoles API endpoint allows any authenticated user to enumerate ACL policies across all organizations CVSS 3.1HIGH 7.7
  • TI-2025-13446 Rapid7 Velociraptor Directory Traversal Vulnerability CVSS 3.1MEDIUM 6.8
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences