Arbitrary File Write in iobroker.admin

Description

Versions of iobroker.admin prior to 3.6.12 are vulnerable to Path Traversal. The package fails to restrict access to folders outside of the intended folder in the /log/ route, which may allow attackers to include arbitrary files in the system.

Recommendation

Update the iobroker.admin package to the latest compatible version. Followings are version details:

• Affected version(s): < 3.6.12
• Patched version(s): 3.6.12

References

• GHSA-54xj-q58h-9x57
• snyk.io
• www.npmjs.com
• CVE-2019-10765
• CWE-22
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• webcrack has an Arbitrary File Write Vulnerability on Windows when Parsing and Saving a Malicious Bundle - CVE-2024-43373
• Rollup 4 has Arbitrary File Write via Path Traversal - CVE-2026-27606
• Flowise is vulnerable to arbitrary file write through its WriteFileTool - CVE-2025-61913
• DbGate: Zip Slip in archive/unzip allows arbitrary file write leading to RCE - CVE-2026-47669

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

iobroker.admin