{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/webui-aria2-all-versions/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ziahamza:webui-aria2:*:*:*:*:*:*:*:*","cpe:2.3:a:ziahamza:webui-aria2:-:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2023-39141"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["webui-aria2 (All versions)"],"_cs_severities":["high"],"_cs_tags":["lfi","vulnerability","webui-aria2"],"_cs_type":"advisory","_cs_vendors":["Ziahamza"],"content_html":"\u003cp\u003eCVE-2023-39141 is a high-severity local file inclusion (LFI) vulnerability affecting Ziahamza webui-aria2. An attacker can exploit this vulnerability without authentication or user interaction to read files from the host filesystem. A proof-of-concept tool has been published, enabling automated file enumeration. All versions of webui-aria2 are currently identified as affected.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in unauthorized disclosure of sensitive files residing on the host system. This may include configuration files, credentials, or system information, depending on the service account privileges under which the webui-aria2 process is running.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify and inventory all instances of Ziahamza webui-aria2 within the environment.\u003c/li\u003e\n\u003cli\u003eRestrict network access to webui-aria2 instances, ensuring they are not exposed to the public internet.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for requests containing directory traversal patterns (e.g., ../) or suspicious file path enumeration attempts targeting webui-aria2 endpoints.\u003c/li\u003e\n\u003cli\u003eReview the referenced GitHub Gist to understand the exploitation path and validate if internal WAF or IDS signatures can detect the documented exploit patterns.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-29T11:01:54Z","date_published":"2026-10-29T11:01:54Z","id":"https://feed.craftedsignal.io/briefs/2026-10-webui-aria2-lfi/","summary":"An unauthenticated local file inclusion vulnerability in Ziahamza webui-aria2 allows remote attackers to perform file enumeration, with publicly available proof-of-concept exploit code increasing the risk of information disclosure.","title":"Ziahamza webui-aria2: Local file inclusion (CVE-2023-39141)","url":"https://feed.craftedsignal.io/briefs/2026-10-webui-aria2-lfi/"}],"language":"en","title":"CraftedSignal Threat Feed - Webui-Aria2 (All Versions)","version":"https://jsonfeed.org/version/1.1"}