Read the docs
TI-2026-27027 Aliases CVE-2026-34783GHSA-j6v5-g24h-vg4j

Ferret has a Path Traversal in IO::FS::WRITE allows arbitrary file write when scraping malicious websites

Priority HIGH 70CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Ferret is a declarative system for working with web data. Prior to 2.0.0-alpha.4, a path traversal vulnerability in Ferret's IO::FS::WRITE standard library function allows a malicious website to write arbitrary files to the filesystem of the machine running Ferret. When an operator scrapes a website that returns filenames containing ../ sequences, and uses those filenames to construct output paths (a standard scraping pattern), the attacker controls both the destination path and the file content. This can lead to remote code execution via cron jobs, SSH authorized_keys, shell profiles, or web shells. This vulnerability is fixed in 2.0.0-alpha.4.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00523 44th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed ferret (MontFerret): 2.0.0-alpha.4github.com/MontFerret/ferret/v2 (Go): 2.0.0-alpha.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MontFerretferretbefore 2.0.0-alpha.42.0.0-alpha.4Patch availableCNA
—github.com/MontFerret/ferret/v2 (Go)before 2.0.0-alpha.42.0.0-alpha.4Patch availableGHSA-j6v5-g24h-vg4j
—github.com/MontFerret/ferret (Go)up to 0.18.1—No fix listedGHSA-j6v5-g24h-vg4j
  • ferret VendorMontFerret Affected before 2.0.0-alpha.4 Fixed in 2.0.0-alpha.4 Patch available CNA
  • github.com/MontFerret/ferret/v2 (Go) Vendor— Affected before 2.0.0-alpha.4 Fixed in 2.0.0-alpha.4 Patch available GHSA-j6v5-g24h-vg4j
  • github.com/MontFerret/ferret (Go) Vendor— Affected up to 0.18.1 Fixed in — No fix listed GHSA-j6v5-g24h-vg4j

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:montferret:ferret:*:*:*:*:*:go:*:*before 2.0.0VulnerableMontFerret
cpe:2.3:a:montferret:ferret:2.0.0:alpha1:*:*:*:go:*:*2.0.0 alpha1VulnerableMontFerret
cpe:2.3:a:montferret:ferret:2.0.0:alpha2:*:*:*:go:*:*2.0.0 alpha2VulnerableMontFerret
cpe:2.3:a:montferret:ferret:2.0.0:alpha3:*:*:*:go:*:*2.0.0 alpha3VulnerableMontFerret
  • cpe:2.3:a:montferret:ferret:*:*:*:*:*:go:*:* Versions before 2.0.0 Vulnerable ·MontFerret
  • cpe:2.3:a:montferret:ferret:2.0.0:alpha1:*:*:*:go:*:* Versions 2.0.0 alpha1 Vulnerable ·MontFerret
  • cpe:2.3:a:montferret:ferret:2.0.0:alpha2:*:*:*:go:*:* Versions 2.0.0 alpha2 Vulnerable ·MontFerret
  • cpe:2.3:a:montferret:ferret:2.0.0:alpha3:*:*:*:go:*:* Versions 2.0.0 alpha3 Vulnerable ·MontFerret

Remediation

  • Fix · CNA ferret (MontFerret) Fixed in 2.0.0-alpha.4
  • Fix · GHSA-j6v5-g24h-vg4j github.com/MontFerret/ferret/v2 (Go) Fixed in 2.0.0-alpha.4 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-34783
  2. 2026-10-03 Alias added: GHSA-j6v5-g24h-vg4j
  3. 2026-10-25 EPSS moved to the below the 50th percentile

References

Exploit 1

Patch 1

Advisory 1

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences