CVE-2023-35844: Lightdash

High severity, CVSS 7.5. EPSS: 6.3% chance of exploitation in the next 30 days.

packages/backend/src/routers in Lightdash before 0.510.3 has insecure file endpoints, e.g., they allow .. directory traversal and do not ensure that an intended file extension (.csv or .png) is used.

Affected products

• Lightdash Lightdash: before 0.510.3 (fixed in 0.510.3)

Published 2023-06-19. Last modified 2026-06-17.