Jan path traversal vulnerability - @janhq/core - GHSA-5jqc-qj57-4hrc

Description

Jan v0.4.12 was discovered to contain an arbitrary file read vulnerability via the /v1/app/readFileSync interface.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 0.1.11

References

• GHSA-5jqc-qj57-4hrc
• CVE-2024-36857
• CWE-22
• CWE-31
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Jan path traversal vulnerability - @janhq/core - CVE-2024-36858
• Jan path traversal vulnerability - CVE-2024-37273
• Saltcorn Server allows logged-in users to delete arbitrary files because of a path traversal vulnerability - CVE-2024-47818
• Agnai File Disclosure Vulnerability: JSON via Path Traversal - CVE-2024-47170

You might also like:

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

Exploiting Server Version Disclosure

CSRF, XXE, and 12 Other Security Acronyms Explained

Tags:

npm

@janhq/core