TI-2024-20597 Aliases CVE-2024-31220

Sunshine vulnerable to remote unauthenticated arbitrary file read

LOW 33CWE-22Published 2024-04-05 · Updated 2024-08-02

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: Low · Low · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Sunshine is a self-hosted game stream host for Moonlight. Starting in version 0.16.0 and prior to version 0.18.0, an attacker may be able to remotely read arbitrary files without authentication due to a path traversal vulnerability. Users who exposed the Sunshine configuration web user interface outside of localhost may be affected, depending on firewall configuration. To exploit vulnerability, attacker could make an http/s request to the `node_modules` endpoint if user exposed Sunshine config web server to internet or attacker is on the LAN. Version 0.18.0 contains a patch for this issue. As a workaround, one may block access to Sunshine via firewall.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00491 42nd percentileScored 2026-11-07

Fix Fixed Sunshine (LizardByte): 0.18.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
LizardByte	Sunshine	0.16.0 to before 0.18.0	0.18.0	Patch available	CNA

Sunshine VendorLizardByte Affected 0.16.0 to before 0.18.0 Fixed in 0.18.0 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:lizardbyte:sunshine::::::::	0.16.0 to before 0.18.0	Vulnerable	LizardByte

cpe:2.3:a:lizardbyte:sunshine:*:*:*:*:*:*:*:* Versions 0.16.0 to before 0.18.0 Vulnerable ·LizardByte

Remediation

Fix · CNA Sunshine (LizardByte) Fixed in 0.18.0

Timeline

2026-10-02 Threatist record created from CVE-2024-31220

References

Advisory 1

https://github.com/LizardByte/Sunshine/security/advisories/GHSA-6rg7-7m3w-w5wc

Other 1

https://github.com/LizardByte/Sunshine/releases/tag/v0.18.0

TI-2026-24782 Sunshine: Authentication bypass via improper client certificate validation CVSS 3.1CRITICAL 9.8
TI-2025-33924 SunshineService Has Unquoted Service Path That Allows Local SYSTEM Code Execution CVSS 3.1HIGH 7.0
TI-2025-33088 Sunshine application-wide CSRF in the UI leads to command injection as Administrator CVSS 3.1CRITICAL 9.7
TI-2024-34644 Sunshine improperly enforces pairing protocol request order CVSS 4.0HIGH 7.7
TI-2025-09364 A local privilege escalation vulnerability exists in LizardBytes' Sunshine for Windows CVSS 3.1HIGH 7.8
TI-2025-09363 LizardBytes Sunshine for Windows contains a DLL search-order hijacking vulnerability CVSS 3.1HIGH 7.8

See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences