---
schema_version: '1.0'
id: security-20260714-163dc6
url: https://osv.dev/vulnerability/PYSEC-2026-2281
url_hash: 163dc6a962d05848732d60a623b8294663c86da88d036ee7a6ca314a1651bf76
canonical_url: https://osv.dev/vulnerability/PYSEC-2026-2281
source: osv:pypa
category: security/library
category_raw: cve/library
region: null
tags:
- cve
- CVE-2026-48818
- PYSEC-2026-2281
- severity:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- starlette
- PyPI
lang: en
published_at: '2026-06-17T19:18:09Z'
fetched_at: '2026-07-14T06:42:23Z'
updated_at: '2026-07-14T06:44:25Z'
status: published
content_hash: 1aca064567736d37b6b71720d02dea4b1f6ddf3871b241fb4e57199edbb2516b
license_note: full
summary: Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and
  earlier, StaticFiles on Windows is vulnerable to SSRF. An UNC path such as \\attacker.com\share
  can cause os.path.realpath to initiate an outbound SMB connection before the path
  is rejected, exposing the ser
summary_source: rss
summary_en: Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and
  earlier, StaticFiles on Windows is vulnerable to SSRF. An UNC path such as \\attacker.com\share
  can cause os.path.realpath to initiate an outbound SMB connection before the path
  is rejected, exposing the ser
entities:
- name: Starlette
  type: organization
key_facts: []
related: []
related_auto:
- name: Hermes
  type: artifact
  weight: 2.0
- name: hermes
  type: concept
  weight: 1.0
title: CVE-2026-48818 — starlette
---

# CVE-2026-48818 — starlette

## TL;DR
Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and earlier, StaticFiles on Windows is vulnerable to SSRF. An UNC path such as \\attacker.com\share can cause os.path.realpath to initiate an outbound SMB connection before the path is rejected, exposing the ser

## Key Points
- cve / CVE-2026-48818 / PYSEC-2026-2281 / severity:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N / starlette / PyPI

## Details
**Severity:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
**Advisory:** PYSEC-2026-2281 (CVE-2026-48818)

**Affected (your watchlist):**
- `PyPI:starlette` 0.41.3 → fixed in 1.1.0 [docker/docker-portal]
- `PyPI:starlette` 1.0.0 → fixed in 1.1.0 [docker/local]

**Details:**
Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and earlier, StaticFiles on Windows is vulnerable to SSRF. An UNC path such as \\attacker.com\share can cause os.path.realpath to initiate an outbound SMB connection before the path is rejected, exposing the service account’s NTLMv2 credentials for offline cracking or relay even though the HTTP response is only a 404. The issue affects default follow_symlink=False deployments, including frameworks built on Starlette such as FastAPI; POSIX systems and follow_symlink=True are unaffected. The issue is fixed in 1.1.0.

**References:**
- https://access.redhat.com/security/cve/CVE-2026-48818
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48818.json
- https://access.redhat.com/errata/RHSA-2026:30087
- https://access.redhat.com/errata/RHSA-2026:30088
- https://access.redhat.com/errata/RHSA-2026:30089
- https://github.com/Kludex/starlette/releases/tag/1.1.0
- https://github.com/Kludex/starlette/security/advisories/GHSA-wqp7-x3pw-xc5r
- https://bugzilla.redhat.com/show_bug.cgi?id=2490020
- https://github.com/Kludex/starlette/commit/fd53168a7767b6b55ba5af787fd88f49e33cabc5
- https://github.com/Kludex/starlette/pull/3287

_Data: OSV.dev (upstream: pypa) — https://osv.dev/vulnerability/PYSEC-2026-2281_

## Source
元記事: [CVE-2026-48818 — starlette](https://osv.dev/vulnerability/PYSEC-2026-2281) — published 2026-06-17T19:18:09Z