Kinto Attachment's attachments can be replaced on read-only records
Impact
The attachment file of an existing record can be replaced if the user has "read" permission on one of the parent (collection or bucket).
And if the "read" permission is given to "system.Everyone" on one of the parent, then the attachment can be replaced on a record using an anonymous request.
Note that if the parent has no explicit read permission, then the records attachments are safe.
Patches
- Patch released in kinto-attachment 6.4.0
- https://github.com/Kinto/kinto-attachment/commit/f4a31484f5925cbc02b59ebd37554538ab826ca1
Workarounds
None if the read permission has to remain granted.
Updating to 6.4.0 or applying the patch individually (if updating is not feasible) is strongly recommended.
References
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | kinto-attachment | < 6.4.0 | 6.4.0 |
References
- https://github.com/Kinto/kinto-attachment/security/advisories/GHSA-hvp4-vrv2-8wrq
- https://github.com/Kinto/kinto-attachment/commit/f4a31484f5925cbc02b59ebd37554538ab826ca1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1879034
- https://github.com/Kinto/kinto-attachment
- https://pypi.org/project/kinto-attachment
- https://github.com/advisories/GHSA-hvp4-vrv2-8wrq
- https://nvd.nist.gov/vuln/detail/CVE-2024-1314
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N- Weakness (CWE)
-- Platform
- Python (PyPI)
- Package
kinto-attachment- Disclosed
- 08.02.2024
- Updated
- 11.10.2026 13:18
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2026-1494 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-hvp4-vrv2-8wrq - CC BY 4.0
Vulnerability history: kinto-attachment
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.