CVE-2025-51481

low-risk

Published 2025-07-22

Local File Inclusion in dagster._grpc.impl.get_notebook_data in Dagster 1.10.14 allows attackers with access to the gRPC server to read arbitrary files by supplying path traversal sequences in the notebook_path field of ExternalNotebookData requests, bypassing the intended extension-based check.

Do I need to act?

0.05% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 6.6/10 Medium

LOCAL / LOW complexity

Affected Products (1)

Dagster

Affected Vendors

Dagsterlabs

References (3)

Product https://github.com/dagster-io/dagster

Exploit https://github.com/dagster-io/dagster/pull/30002

Exploit https://www.gecko.security/blog/cve-2025-51481

/ 100

low-risk

Severity 21/34 · High

Exploitability 0/34 · Minimal

Exposure 5/34 · Minimal