CVE-2022-31504: Baiduwenkuspider Flaskweb Project Baiduwenkuspider Flaskweb

Critical severity, CVSS 9.3. EPSS: 1.5% chance of exploitation in the next 30 days.

The ChangeWeDer/BaiduWenkuSpider_flaskWeb repository before 2021-11-29 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.

Affected products

• Baiduwenkuspider Flaskweb Project Baiduwenkuspider Flaskweb: before 2021-11-29 (fixed in 2021-11-29)

Published 2022-07-11. Last modified 2026-06-17.