CVE-2018-12563: Linaro Lava

Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days.

An issue was discovered in Linaro LAVA before 2018.5.post1. Because of support for file: URLs, a user can force lava-server-gunicorn to download any file from the filesystem if it's readable by lavaserver and valid yaml.

Affected products

• Linaro Lava: before 2018.5.post1 (fixed in 2018.5.post1)

Published 2018-06-19. Last modified 2026-06-17.