Kroki TikZ secure mode allows arbitrary file reads
Secret files on a diagram server can be read by anyone.
Summary
Kroki creates diagrams from text descriptions. With KROKI_SAFE_MODE enabled, the TikZ renderer lets an unauthenticated attacker's LaTeX read any file the Kroki container user can access and show it in the returned SVG.
Affected when
- KROKI_SAFE_MODE enabled
- TikZ backend in use
What to do
Update to 0.31.2 or later.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen