CVE-2013-7300: Absolute path traversal vulnerability in cantata before 1.2.2 allows local users to read arbitrary files vi...

Security readout for executives and security teams

Cantata before 1.2.2 had a file-read flaw in its internal HTTP server. A local user could request a full file path and read files the service could access. The CVE notes remote abuse may be possible when combined with CVE-2013-7301. No active exploitation evidence is provided in the source bundle. Exposure is most likely on systems running Cantata before 1.2.2 where untrusted local users exist. Remote exposure should be assessed only where CVE-2013-7301 also applies or the internal httpd is reachable beyond trusted boundaries. Treat this as a targeted exposure cleanup, not an emergency based on provided evidence. Prioritize systems with shared-user access, sensitive local files, or any path to remote reach through CVE-2013-7301. Mitigation focus: Upgrade Cantata to 1.2.2 or later where applicable.; Restrict internal httpd access to trusted local contexts.; Disable unused internal httpd functionality if vendor guidance supports it..

Prepared

Jun 14, 2026, 14:50 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.