CVE-2026-48818
2 advisories.
PyPI/starlette CVE-2026-48818: high 7.5
Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows
Action: Upgrade starlette to 1.1.0 or later.
pip install starlette==1.1.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.1.0 | - |
Fixed versions
| 1.1.0 |
Sources
- osv: GHSA-wqp7-x3pw-xc5r
- https://github.com/Kludex/starlette/security/advisories/GHSA-wqp7-x3pw-xc5r
- https://github.com/Kludex/starlette
CVE-2026-48818 · published · modified · JSON
PyPI/starlette CVE-2026-48818: high 7.5
Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and earlier, StaticFiles on Windows is vulnerable to SSRF. An UNC path such as \\attacker.com\share can cause os.path.realpath to i
Action: Upgrade starlette to 1.1.0 or later.
pip install starlette==1.1.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.1.0 | - |
Fixed versions
| 1.1.0 |
Sources
- osv: PYSEC-2026-2281
- https://access.redhat.com/security/cve/CVE-2026-48818
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48818.json
- https://access.redhat.com/errata/RHSA-2026:30087
- https://access.redhat.com/errata/RHSA-2026:30088
- https://access.redhat.com/errata/RHSA-2026:30089
- https://github.com/Kludex/starlette/releases/tag/1.1.0
- https://github.com/Kludex/starlette/security/advisories/GHSA-wqp7-x3pw-xc5r
- https://bugzilla.redhat.com/show_bug.cgi?id=2490020
- https://github.com/Kludex/starlette/commit/fd53168a7767b6b55ba5af787fd88f49e33cabc5
- https://github.com/Kludex/starlette/pull/3287
CVE-2026-48818 · published · modified · JSON