CVE-2026-34783: Path Traversal in Ferret

The core of the vulnerability lies in Ferret's IO::FS::WRITE function. When scraping websites, Ferret typically uses filenames returned by the scraped site to determine where to save data. An attacker can craft a website that returns filenames containing ../ sequences. Ferret, without proper sanitization, will interpret these sequences as directory traversal instructions, allowing the attacker to write files outside of the intended output directory. This could involve overwriting critical system files like cron job scripts, SSH authorized keys, or shell profiles. Successful exploitation could lead to complete system compromise, allowing the attacker to execute arbitrary code with the privileges of the Ferret process.

1. Reserved2026-03-30
2. Published2026-04-06
3. Modified2026-04-07
4. EPSS updated2026-04-14

The primary mitigation is to upgrade to Ferret version 2.0.0-alpha.4 or later, which includes the necessary fix to prevent path traversal. If upgrading immediately is not feasible, consider implementing input validation to sanitize filenames received from external sources. Specifically, strip or reject any filenames containing ../ sequences before passing them to Ferret’s IO::FS::WRITE function. While a WAF might offer some protection, it's unlikely to be effective against this type of vulnerability as it occurs within the application logic. After upgrading, verify the fix by attempting to scrape a website designed to trigger the path traversal vulnerability and confirm that files are not written to unintended locations.