{"data":{"id":"79d98a02-0f84-4948-b3bc-b31574d2e94a","title":"CVE-2023-46315: The zanllp sd-webui-infinite-image-browsing (aka Infinite Image Browsing) extension before 977815a for…","summary":"The zanllp sd-webui-infinite-image-browsing extension (aka Infinite Image Browsing) before 977815a for stable-diffusion-webui allows remote attackers to read any local file via /file?path= when Gradio authentication is enabled without a secret key configured. The source demonstrates reading /proc/self/environ to discover credentials. The weakness is classified as CWE-200, Exposure of Sensitive Information to an Unauthorized Actor.","solution":"The source links a patch commit, 977815a2b28ad953c10ef0114c365f698c4b8f19, in the project's pull request 368, and notes the fix as \"before 977815a\". It does not state any configuration change or workaround beyond that.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2023-46315","publishedAt":"2023-10-23T02:15:08.797Z","cveId":"CVE-2023-46315","cweIds":["CWE-200"],"cvssScore":"7.5","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["stable-diffusion-webui","Stable Diffusion","sd-webui-infinite-image-browsing","Gradio"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"zanllp sd-webui-infinite-image-browsing arbitrary local file read via /file","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00759,"epssCheckedAt":"2026-11-04T12:08:33.434Z","kevDateAdded":null,"advisoryAliases":["GHSA-jq2h-j9qf-53rv"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-10-29T06:09:54.595Z","patchAvailable":null,"disclosureDate":null,"fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-116"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality"],"aiComponentTargeted":"plugin","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[]}}