Jan path traversal vulnerability

Description

An arbitrary file upload vulnerability in the /v1/app/appendFileSync interface of Jan v0.4.12 allows attackers to execute arbitrary code via uploading a crafted file.

Recommendation

No fix is available yet. Followings are affected versions:

<= 0.1.11

References

Could your website be exposed too?

SmartScanner can check your website for Jan path traversal vulnerability and gives you actionable findings to investigate.

Start a free scan

Related Issues

Jan path traversal vulnerability - @janhq/core - CVE-2024-36858
Jan path traversal vulnerability - @janhq/core - GHSA-5jqc-qj57-4hrc - CVE-2024-36857
Langchain Path Traversal vulnerability - CVE-2024-7774
Saltcorn Server allows logged-in users to delete arbitrary files because of a path traversal vulnerability - CVE-2024-47818

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

Exploiting Server Version Disclosure

CSRF, XXE, and 12 Other Security Acronyms Explained

See something that needs correcting? Let us knowUpdated August 15, 2024