ethyca-fides Webserver API Path Traversal vulnerability (CVE-2023-36827) | HOL Guard CVE

High · CVSS 7.5CVE-2023-36827GHSA-R25M-CR6V-P9HQ

ethyca-fides Webserver API Path Traversal vulnerability

Answer in brief

CVE-2023-36827 records a High severity (CVSS 7.5) vulnerability in ethyca-fides Webserver API Path Traversal vulnerability. The current sources do not mark it as known exploited. The current feed maps ethyca-fides (pypi). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Jul 6, 2023Updated Sep 10, 2026Source checked Sep 10, 2026First seen by HOL Aug 7, 2026Material review Sep 10, 2026

Upstream Advisory

Key facts

Risk: High · CVSS 7.5
Exploitation: Not marked as known exploited
Affected software: 1 mapped package or product
Fix availability: Available

Why this deserves its current priority

CVSS is 7.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps ethyca-fides (pypi). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
ethyca-fidespypi	>=0 <2.15.1	2.15.1

Recommended response

Check inventory. Check lockfiles and deployed manifests for ethyca-fides.
Review the reported fix. Update ethyca-fides to 2.15.1 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Jul 6, 2023
Evidence: source:osv:source_dates:source-dates:record
Source modified
Sep 10, 2026
Evidence: source:osv:source_dates:source-dates:record
First seen by HOL
Aug 7, 2026

Sources and claim methodology

Upstream source description

### Impact A path traversal (directory traversal) vulnerability affects fides versions lower than `2.15.1`, allowing remote attackers to access arbitrary files on the fides webserver container's filesystem. ### Patches The vulnerability is patched in fides `2.15.1`. Users should upgrade to this version. ### Workarounds If the Fides webserver API is not directly accessible to attackers and is instead deployed behind a reverse proxy as recommended in Ethyca's [security best practice documentation](https://docs.ethyca.com/docs/configuration/security-practices#reverse-proxy), and the reverse proxy is an AWS application load balancer, the vulnerability can't be exploited by these attackers. An AWS application load balancer will reject this attack with a 400 error. Additionally, any secrets supplied to the container using environment variables rather than a `fides.toml` configuration file are not affected by this vulnerability.

Quoted source text, attributed separately from HOL analysis.