title: Gotham table and Forward App Path traversal
description: Gotham Table service and Forward App were found to be vulnerable to a Path traversal issue allowing an authenticated user to read arbitrary files on the file system.
problem types: The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize absolute path sequences such as "/abs/path" that can resolve to a location that is outside of that directory.
affected:
{
vendor: Palantir
product: com.palantir.gotham:blackbird-witchcraft
versions:
version: *, versionType: semver, lessThan: 104.30231002.10, status: affected
version: *, versionType: semver, lessThan: 104.30231001.8, status: affected
version: *, versionType: semver, lessThan: 104.30230807.59, status: affected
version: *, versionType: semver, lessThan: 104.30230908.21, status: affected
version: *, versionType: semver, lessThan: 103.30230304.433, status: affected
version: *, versionType: semver, lessThan: 104.30230604.81, status: affected
version: *, versionType: semver, lessThan: 104.30231003.9, status: affected
}
metrics:
cvssV3_1: [
version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
baseSeverity: MEDIUM
baseScore: 6.5
]
format: CVSS