CVE-2022-1554: Path Traversal Vulnerability in scout-browser
Summary
CVE-2022-1554: Path Traversal in scout-browser. Affects scout-browser versions < 4.52. Fixed in 4.52. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Scout is a Variant Call Format (VCF) visualization interface that allows users to visualize genomic data in an interactive manner. It is widely used in bioinformatics for analyzing genetic variations. The scout-browser package, which is part of this interface, has been identified to have a security flaw that could potentially expose sensitive files on the server due to improper handling of file paths.
Vulnerability Detail
The vulnerability in scout-browser arises from a path traversal issue caused by the send_file function. This flaw allows an attacker to manipulate file paths, potentially gaining unauthorized access to files outside the intended directory. If exploited, this could lead to the exposure of sensitive information stored on the server, posing significant risks to data integrity and confidentiality.
How To Fix
Latest published version: 4.115.2 as of 23 Oct 2026
pip install --upgrade "scout-browser==4.115.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.52
This is the first release that contains the fix.
pip install --upgrade "scout-browser==4.52"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you are unable to update the package immediately, consider implementing input validation to sanitize file paths and restrict access to sensitive directories. This can help mitigate the risk of path traversal attacks until a proper update can be applied.
Conclusion
The scout-browser package has a critical path traversal vulnerability that can expose sensitive files on the server. It is crucial to update to version 4.52 or later to mitigate this risk. Users should also consider implementing workarounds until they can apply the necessary updates.
See every vulnerability recorded for scout-browser →
FAQ
A path traversal vulnerability allows an attacker to access files and directories that are stored outside the intended directory by manipulating file paths.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors open-source vulnerabilities without requiring any signup.
Exploitation of this vulnerability could lead to unauthorized access to sensitive files, compromising data integrity and confidentiality.
Yes, the CVSS score for this vulnerability is 6.8, indicating a moderate level of severity.
If an immediate update is not possible, implement input validation to sanitize file paths and restrict access to sensitive directories as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for scout-browser.
