GHSA-8qw9-gf7w-42x5: 
Streamlit vulnerability analysis and mitigation

A minor security issue was identified in Streamlit (pip package streamlit) as a follow-up to CVE-2022-35918, affecting versions >= 0.63.0 and < 1.30.0. The vulnerability is related to custom components in Streamlit apps, where a residual directory traversal issue persisted after the initial fix in version 1.11.1, potentially exposing certain files on the server file-system under specific conditions (GitHub Advisory).

The vulnerability involves the handling of file paths in custom components, where the original fix using os.path.commonprefix was found to be insufficient. The security update in version 1.30.0 implements os.path.commonpath for more secure access control, preventing potential directory traversal attacks through improved path validation (Streamlit Commit).

The vulnerability could potentially allow access to certain files on the server file-system under specific conditions, though the severity is classified as Low (GitHub Advisory).

Users are strongly advised to update to Streamlit version 1.30.0, which contains the security fix. No additional workarounds are necessary once the update is applied (GitHub Advisory).