cve/2023/CVE-2023-34457.md

### [CVE-2023-34457](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-34457)
![](https://img.shields.io/static/v1?label=Product&message=MechanicalSoup&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3D%20%3E%3D%200.2.0%2C%20%3C%201.3.0%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-20%3A%20Improper%20Input%20Validation&color=brighgreen)

### Description

MechanicalSoup is a Python library for automating interaction with websites. Starting in version 0.2.0 and prior to version 1.3.0, a malicious web server can read arbitrary files on the client using a `<input type="file" ...>` inside HTML form. All users of MechanicalSoup's form submission are affected, unless they took very specific (and manual) steps to reset HTML form field values. Version 1.3.0 contains a patch for this issue.

### POC

#### Reference
- https://github.com/MechanicalSoup/MechanicalSoup/security/advisories/GHSA-x456-3ccm-m6j4

#### Github
No PoCs found on GitHub currently.