{"id":"CVE-2022-31573","kind":"vulnerability","aliases":["CVE-2022-31573","GHSA-687h-86vc-5x59"],"related":[],"title":"ChainerRL Visualizer 0.1.1 vulnerable to Path Traversal via unsafe use of send_file function","description":"The chainer/chainerrl-visualizer repository through 0.1.1 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.","summary":"ChainerRL Visualizer 0.1.1 and earlier passes user-supplied paths to Flask's send_file without validation, allowing absolute path traversal. A remote attacker can read arbitrary files the server process can access.","severity":"critical","cvss":9.3,"epss":0.01404,"exploited":false,"exploited_at":null,"products":[{"name":"chainerrl-visualizer","fixed":[],"affected":"<= 0.1.1","ecosystem":"pypi"},{"name":"chainer chainerrl-visualizer","fixed":[],"affected":"<= 0.1.1","ecosystem":"vendor"}],"ecosystems":["pypi","vendor"],"tags":["cwe-22","flask","package","pypi","python","self-hosted"],"not_affected_if":["no-public-exposure","not-installed"],"how_to_check":"- Run `pip show chainerrl-visualizer` and compare the installed version to the affected range (<= `0.1.1`)\n- Check whether the visualizer web endpoints are reachable from untrusted networks","fix":"- Upgrade `chainerrl-visualizer` past `0.1.1`; the fixed version is unknown from the sources\n- If no fixed release exists, remove or restrict access to the visualizer service until patched","status":"open","published_at":"2022-07-11T01:15:10+00:00","first_seen_at":"2026-10-27T16:20:27+00:00","triaged_at":"2026-10-27T16:21:28+00:00","updated_at":"2026-10-27T16:33:08+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-27T16:21:28Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `chainerrl-visualizer` past `0.1.1`; the fixed version is unknown from the sources\n- If no fixed release exists, remove or restrict access to the visualizer service until patched","reach":"unknown","title":"ChainerRL Visualizer: path traversal lets requests read arbitrary server files","impact":"high","summary":"ChainerRL Visualizer 0.1.1 and earlier passes user-supplied paths to Flask's send_file without validation, allowing absolute path traversal. A remote attacker can read arbitrary files the server process can access.","category":"package","nicknames":[],"who_cares":["python","pypi","flask","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker reads arbitrary files from the server filesystem","analyst_note":"Confirm the fixed version and whether the vulnerable endpoint requires authentication or is reachable by default, via GHSA-687h-86vc-5x59.","how_to_check":"- Run `pip show chainerrl-visualizer` and compare the installed version to the affected range (<= `0.1.1`)\n- Check whether the visualizer web endpoints are reachable from untrusted networks","needs_analyst":true,"not_affected_if":["not-installed","no-public-exposure"],"who_is_affected":"Teams running the ChainerRL Visualizer Flask web app that serves files based on request input. Systems that do not install or expose this package are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000606,"input_tokens":3331,"output_tokens":546,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2022':16A,24A '-22':34B '-31573':17A,25A '0.1.1':3A,44B,79C '5x59':22A '687h':20A '86vc':21A 'absolut':60B,83C 'access':74B 'allow':59B,82C 'arbitrari':68B 'attack':65B 'chainer':29A 'chainer/chainerrl-visualizer':76C 'chainerrl':1A,27A,31A,42B 'chainerrl-visualizer':26A,30A 'cve':15A,23A 'cwe':33B 'earlier':46B 'file':13A,56B,69B,90C 'flask':35B,53B,88C 'function':14A,91C 'ghsa':19A 'ghsa-687h-86vc-5x59':18A 'github':81C 'host':41B 'packag':36B 'pass':47B 'path':6A,51B,61B,84C 'process':72B 'pypi':37B 'python':38B 'read':67B 'remot':64B 'repositori':77C 'self':40B 'self-host':39B 'send':12A,55B,89C 'server':71B 'suppli':50B 'travers':7A,62B,85C 'unsaf':9A,94C 'use':10A,93C 'user':49B 'user-suppli':48B 'valid':58B 'via':8A 'visual':2A,43B 'visualizer':28A,32A 'vulner':4A 'without':57B","nicknames":[],"mitigations":[],"who_affected":"Teams running the ChainerRL Visualizer Flask web app that serves files based on request input. Systems that do not install or expose this package are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2022-07-11T01:15:10+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-687h-86vc-5x59","url":"https://github.com/advisories/GHSA-687h-86vc-5x59","severity":"critical","published_at":"2022-07-12T00:00:58+00:00","modified_at":"2026-10-27T16:19:44+00:00","first_seen_at":"2026-10-27T16:20:27+00:00","fetched_at":"2026-10-27T16:25:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2022-31573","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-31573","severity":null,"published_at":"2022-07-11T01:15:10+00:00","modified_at":"2026-06-17T04:45:42+00:00","first_seen_at":"2026-10-27T16:33:08+00:00","fetched_at":"2026-10-27T16:33:08+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}