Skip to content
Fencer Vulns
critical 9.9

CVE-2022-24900 json

Absolute Path Traversal due to incorrect use of `send_file` call in Piano LED Visualizer

published 2022-04-29 4 y ago modified 2026-06-17 4 mo ago also EUVD-2022-29661

cvss
9.9
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
8.4%
EPSS 8.4% chance of exploitation in 30 days, percentile 95%
public exploits
0
none known, plus a Nuclei check

Summary

Piano LED Visualizer is software that allows LED lights to light up as a person plays a piano connected to a computer. Version 1.3 and prior are vulnerable to a path traversal attack. The `os.path.join` call is unsafe for use with untrusted input. When the `os.path.join` call encounters an absolute path, it ignores all the parameters it has encountered till that point and starts working with the new absolute path. Since the "malicious" parameter represents an absolute path, the result of `os.path.join` ignores the static directory completely. Hence, untrusted input is passed via the `os.path.join` call to `flask.send_file` can lead to path traversal attacks. A patch with a fix is available on the `master` branch of the GitHub repository. This can also be fixed by preventing flow of untrusted data to the vulnerable `send_file` function. In case the application logic necessiates this behaviour, one can either use the `flask.safe_join` to join untrusted paths or replace `flask.send_file` calls with `flask.send_from_directory` calls.

Patch / fix

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
partial
Assessed
18 mo ago

Exploit prediction

8.41% chance of exploitation in the next 30 days, higher than 95% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • Nuclei template Piano LED Visualizer 1.3 - Local File Inclusion nuclei detection template
  • github.com https://github.com/onlaj/Piano-LED-Visualizer/pull/351 referenced PoC, tagged "exploit" by a source, unverified
  • github.com https://github.com/onlaj/Piano-LED-Visualizer/security/advisories/GHSA-g78x-q3x8-r6m4 referenced PoC, tagged "exploit" by a source, unverified
  • github.com https://github.com/onlaj/Piano-LED-Visualizer/issues/350 referenced PoC, tagged "exploit" by a source, unverified
  • github.com https://github.com/onlaj/Piano-LED-Visualizer/blob/6a732caa812c83a807c711f3d091af99209cae7b/webinterface/views_api.py#L970 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 9.9 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L
NVD 3.1 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected products

  • onlaj Piano-LED-Visualizer

Classification

Weakness
  • CWE-73 External Control of File Name or Path
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory
  • CWE-668 Exposure of Resource to Wrong Sphere

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.