obsidian-local-rest-api: Authenticated path traversal via URL-encoded %2F in /vault/{path} — arbitrary host file read/wr

Description

The Local REST API’s /vault/{path} endpoints (GET/PUT/PATCH/POST/DELETE) percent-decode the request path inside the handler — after Express has already routed and normalized it, then hand it to the Obsidian vault adapter with no confinement check. A literal ../ is resolved/rejected at the routing layer (→ 404), but %2F is not a separator there, so ..%2F..%2F survives routing and is only turned into a real / by the handler’s decodeURIComponent, reconstituting a `..

Recommendation

No fix is available yet. Followings are affected versions:

• < 4.1.3

References

• GHSA-62gx-5q78-wrvx
• CWE-22
• OWASP 2021-A1

Related Issues

• SillyTavern: Path Traversal in `/api/chats/export` and `/api/chats/delete` allows arbitrary file read/delete within user - CVE-2026-34524
• jsPDF has Local File Inclusion/Path Traversal vulnerability - CVE-2025-68428
• SillyTavern has a path traversal in `/api/chats/import` allows arbitrary file write outside intended chat directory - CVE-2026-34522
• Agnai File Disclosure Vulnerability: JSON via Path Traversal - CVE-2024-47170

You might also like:

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

obsidian-local-rest-api