Ckan remote code execution and private information access via crafted resource ids
Specific vulnerabilities:
- Arbitrary file write in
resource_createandpackage_updateactions, using theResourceUploaderobject. Also reachable viapackage_create,package_revise, andpackage_patchvia calls topackage_update. - Remote code execution via unsafe pickle loading, via Beaker's session store when configured to use the file session store backend.
- Potential DOS due to lack of a length check on the resource id.
- Information disclosure: A user with permission to create a resource can access any other resource on the system if they know the id, even if they don't have access to it.
- Resource overwrite: A user with permission to create a resource can overwrite any resource if they know the id, even if they don't have access to it.
Impact
A user with permissions to create or edit a dataset can upload a resource with a specially crafted id to write the uploaded file in an arbitrary location. This can be leveraged to Remote Code Execution via Beaker's insecure pickle loading.
Patches
All the above listed vulnerabilities have been fixed in CKAN 2.9.9 and CKAN 2.10.1 The patches for CKAN 2.9 should apply easily to previous CKAN versions.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | ckan | < 2.9.9, = 2.10.0 | 2.9.9 |
References
- https://github.com/ckan/ckan/security/advisories/GHSA-446m-hmmm-hm8m
- https://nvd.nist.gov/vuln/detail/CVE-2023-32321
- https://github.com/ckan/ckan
- https://github.com/ckan/ckan/blob/2a6080e61d5601fa0e2a0317afd6a8e9b7abf6dd/CHANGELOG.rst
- https://pypi.org/project/ckan
- https://github.com/advisories/GHSA-446m-hmmm-hm8m
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- Weakness (CWE)
CWE-20- Platform
- Python (PyPI)
- Package
ckan- Disclosed
- 24.05.2023
- Updated
- 11.10.2026 15:17
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2026-312 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-446m-hmmm-hm8m - CC BY 4.0
Vulnerability history: ckan
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 15
- First → latest
- 12.2021 04.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 1
- High 3
- Medium 11
Disclosures per year
- 2021: 1
- 2022: 1
- 2023: 2
- 2024: 4
- 2025: 3
- 2026: 4
-
Ckan remote code execution and private information access via crafted resource ids this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.