The mkdocs 1.2.2 built-in dev-server allows directory traversal using the port 8000, enabling remote exploitation to obtain :sensitive information.

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-40978
• mkdocs/mkdocs#2601
• https://github.com/mkdocs/mkdocs
• nisdn/CVE-2021-40978#1
• mkdocs/mkdocs#2604
• https://github.com/mkdocs/mkdocs/releases/tag/1.2.3
• https://github.com/nisdn/CVE-2021-40978
• mkdocs/mkdocs@5754091
• https://github.com/pypa/advisory-database/tree/main/vulns/mkdocs/PYSEC-2021-878.yaml
• mkdocs/mkdocs@1b15412