CVE-2026-13748

Katalog CVE

CVSS 6.3 · Medium EPSS 0,19%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada snowflake cli. Skor CVSS 3.1 6.3 (Medium) menurut CNA.

Deskripsi (NVD)

Improper restriction of file path resolution in Snowflake CLI versions prior to 3.19 allowed arbitrary local file content to be read and transmitted to Snowflake services. An attacker could exploit this by supplying crafted repository or project content that referenced files outside the intended project boundary, causing Snowflake CLI to read local files and upload or embed their contents during deployment or SQL template processing. Successful exploitation required the victim to process attacker-controlled project content, and retrieval of exfiltrated data depended on access to the victim's Snowflake account artifacts such as query history or uploaded stage content. The fix is available in Snowflake CLI version 3.19, and users must manually upgrade.

Rincian

Terbit di NVD

29 Juni 2026

Terakhir diubah

30 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.3 (Medium), sumber CNA
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-61: UNIX Symbolic Link (Symlink) Following
CWE-73: External Control of File Name or Path

EPSS (30 hari)

0,19% peluang dieksploitasi; lebih tinggi dari 7,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://community.snowflake.com/s/article/Snowflake-CLI-Vulnerability-Advisory advisory vendor