Crafatar vulnerabilities
We track 1 vulnerability in Crafatar products. 1 is rated high or critical, and none are known to be exploited. The most recent was published on February 1, 2024.
1vulnerabilities
0critical
1high
0exploited
7.5average CVSS score
Latest Crafatar vulnerabilities
- 7.5 High severity
crafatar: Improper Limitation of a Pathname to a Restricted Directory
Crafatar serves Minecraft avatars based on the skin for use in external applications. Files outside of the `lib/public/` directory can be requested from the server. Instances running behind Cloudflare (including crafatar.com) are not affected. Instances using