Request CVE-ID and GitHub Security Advisory for Fixed Path Traversal Vulnerability (VULN-183589)

[g0w6y]

Hi Team,

I am the security researcher who reported the path traversal vulnerability in mssql-python.

Report Details:

• Submitted to MSRC on April 20, 2026 (VULN-183589, Case 113816)
• CWE: CWE-22 (Path Traversal)
• CVSS v3.1: 7.5 High (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L)

Vulnerability:
The setup_logging(log_file_path=...) function only performed an extension check and was vulnerable to directory traversal, allowing arbitrary file writes.

Fix:

• Fixed in PR #530
• Released in v1.6.0

The issue is now resolved.

Request:
I kindly request the maintainers to:

1. Create a GitHub Security Advisory for this vulnerability.
2. Request a CVE-ID from MITRE.

Assigning a CVE will help with proper tracking by vulnerability scanners, Linux distributions, and the broader security community.

Thank you for your time and for merging the fix quickly.

Best regards,
Gouri Sankar A

[github-actions]

Hi @g0w6y, thank you for opening this issue!

Our team will review it shortly. We aim to triage all new issues within 24-48 hours and get back to you.

If you have additional information to share, please feel free to update the issue.

Thank you for your patience!