What is CVE-2024-40348?

CVE-2024-40348 is a high-severity vulnerability in Bazarr, classified under Path Traversal. CVSS score: 8.2/10. Published 2024-07-20.

How severe is CVE-2024-40348?

High severity. CVSS v3 base score is 8.2 out of 10.

Is CVE-2024-40348 known to be exploited?

28 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Path Traversal in Bazarr

CVE-2024-40348

An issue in the component /api/swaggerui/static of Bazaar v1.4.3 allows unauthenticated attackers to execute a directory traversal.

Vulnerability class: Path Traversal (Directory Traversal)

Published 2024-07-20 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 8.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L.

EPSS exploit prediction

EPSS: 0.082 (94.7th percentile), scored 2026-10-07.

Low probability of exploitation in the next 30 days, but still tracked. 95th percentile — 94.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.082 · newest: 0.082 · change: 0.000

Affected products

Bazarr

Weakness classification (CWE)

CWE-22 — Path Traversal

Public proof-of-concept exploits

References

github.com/4rdr/proofs/blob/main/info/Bazaar_1.4.3_File_Traversal_via_Filename… (Third Party Advisory)

Frequently asked questions

What is CVE-2024-40348?: CVE-2024-40348 is a high-severity vulnerability in Bazarr, classified under Path Traversal. CVSS score: 8.2/10. Published 2024-07-20.
How severe is CVE-2024-40348?: High severity. CVSS v3 base score is 8.2 out of 10.
Is CVE-2024-40348 known to be exploited?: 28 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.