obsidian-local-rest-api: Authenticated path traversal via URL-encoded %2F in /vault/{path} — arbitrary host file read/wr

Description

The Local REST API’s /vault/{path} endpoints (GET/PUT/PATCH/POST/DELETE) percent-decode the request path inside the handler — after Express has already routed and normalized it, then hand it to the Obsidian vault adapter with no confinement check. A literal ../ is resolved/rejected at the routing layer (→ 404), but %2F is not a separator there, so ..%2F..%2F survives routing and is only turned into a real / by the handler’s decodeURIComponent, reconstituting a `..

Recommendation

No fix is available yet. Followings are affected versions:

• < 4.1.3

References

• GHSA-62gx-5q78-wrvx
• CWE-22
• OWASP 2021-A1