CVE-2020-15239: xmpp-http-upload Information Disclosure and Directory Traversal Vulnerability
Summary
CVE-2020-15239: In xmpp-http-upload before version 0.4.0, when the GET method is attacked, attackers can read files which have a .data suffix and which are accompanied by a JSON file with the .meta suffix. Affects xmpp-http-upload across 2 version ranges.
< 0.4.0
< 82056540191e89f0cd697c81f57714c00962ed75
Fixed in 82056540191e89f0cd697c81f57714c00962ed75. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
xmpp-http-upload is a Python package available on PyPI that provides a mechanism for uploading files via XMPP. It allows users to upload files to an XMPP server using the HTTP protocol. The package is commonly used in XMPP-based applications to facilitate file sharing and transfer. However, a vulnerability has been discovered in versions prior to 0.4.0 that allows attackers to read files and potentially circumvent authentication or other limitations on outbound traffic.
Vulnerability Detail
The vulnerability in xmpp-http-upload arises when the application is attacked using the GET method. Attackers can exploit this vulnerability to read files with a .data suffix, which must be accompanied by a JSON file with a .meta suffix. This can lead to information disclosure and, in certain shared-hosting scenarios, enable attackers to bypass authentication or other restrictions on outbound traffic. For instance, if a server has multiple instances of the application running with separate DATA_ROOT settings, an attacker with knowledge of the directory structure can read files from any other instance to which the process has read access. This allows them to retrieve data from other instances, potentially circumventing authentication or quota limits. Additionally, if the associated XMPP server or anyone with knowledge of the SECRET_KEY is malicious, they can write files outside the DATA_ROOT directory. The files written are constrained to have the .meta and .data suffixes, with the .meta file containing the JSON payload and the .data file containing the original request's payload.
How To Fix
Latest published version: 0.4.0 as of 22 Oct 2026
pip install --upgrade "xmpp-http-upload==0.4.0"The newest release already contains this fix.
If you need the minimum change
82056540191e89f0cd697c81f57714c00962ed75
This is the first release that contains the fix.
pip install --upgrade "xmpp-http-upload==82056540191e89f0cd697c81f57714c00962ed75"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the patched version of xmpp-http-upload to mitigate the risk of exploitation.
Conclusion
The xmpp-http-upload package prior to version 0.4.0 is vulnerable to information disclosure and directory traversal attacks. It is crucial to update to the patched version to mitigate the risk of exploitation. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for xmpp-http-upload →
FAQ
xmpp-http-upload is a Python package that enables file uploads via XMPP using the HTTP protocol. It is commonly used in XMPP-based applications for file sharing and transfer.
The vulnerability allows attackers to read files and potentially bypass authentication or other restrictions on outbound traffic. It can lead to information disclosure and unauthorized access to sensitive data.
To fix this vulnerability, it is recommended to upgrade to version 0.4.0 or later of xmpp-http-upload.
There are no known workarounds for this vulnerability. Updating to the patched version is the only recommended solution.
This vulnerability does not pose a direct risk of data loss. However, it can lead to unauthorized access to sensitive data, potentially resulting in data breaches or privacy violations.
