CVE-2023-49801 is a medium severity (CVSS 4.2) path traversal in the get_pfp and get_banner routes of Lif Auth Server. The server does not check the requested file, so a caller may read files outside the intended folder. The fix is version 1.4.0, so upgrade.
What's affected
The record says the routes have no check on the file they receive through the URL. The GitHub advisory GHSA-3v77-pvqq-qg3f lists versions 1.3.2 and earlier as affected, in auth_server.py, and 1.4.0 as patched. The CVE record states the fix as 1.4.0 as well.
The weaknesses are CWE-22 (path traversal) and CWE-23 (relative path traversal). The vector is CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N. The advisory calls it Moderate.
Fixed version: 1.4.0 or later. The advisory lists no workaround, so upgrading is the remedy.
How to check if you're exposed
Find the Lif Auth Server version you run, from your deployment files or the repository tag.
git describe --tags
pip list 2>/dev/null | grep -i lif
If you only use the hosted Lif service, the operator is responsible for the server and you cannot patch it yourself. Self hosters need the upgrade. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan checks the open source packages in a manifest against known CVEs. It only sees what you give it, so it will not find a firmware image or a hosted product on its own. Use it for the code you ship and your asset list for everything else.
What to do now
- Identify every self hosted Lif Auth Server.
- Upgrade to 1.4.0 or later.
- Run the service as a user that can read only the files it needs, so a traversal reaches little.
- Review access logs for requests to the profile picture and banner routes that contain parent folder sequences.
- Rotate any secret stored in files the service account could read.
Why it matters
Path traversal happens when a server joins user supplied text to a base folder and does not confirm the result is still inside it. The caller then reaches files elsewhere on disk.
Here the leaked content is limited by what the service account can read, which explains the medium score. Least privilege file access is the cheap second line of defense. This CVE is not on the CISA KEV list.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which version fixes it?
1.4.0, per the advisory and the record.
Which routes are affected?
The get_pfp and get_banner routes.
Sources
Last reviewed: 19 October 2026.
