Description
A logged-in user with any role can delete arbitrary files on the filesystem by calling the sync/clean_sync_dir endpoint. The dir_name POST parameter is not validated/sanitized and is used to construct the syncDir that is deleted by calling fs.rm.
Recommendation
Update the @saltcorn/server package to the latest compatible version. Followings are version details:
- Affected version(s): <= 1.0.0-beta.15
- Patched version(s): 1.0.0-beta.16
References
Could your website be exposed too?
SmartScanner can check your website for Saltcorn Server allows logged-in users to delete arbitrary files because of a path traversal vulnerability and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Saltcorn has an Unauthenticated Path Traversal in sync endpoints, allowing arbitrary file write and directory read - CVE-2026-40163
- SillyTavern: Path Traversal in `/api/chats/export` and `/api/chats/delete` allows arbitrary file read/delete within user - CVE-2026-34524
- Langchain Path Traversal vulnerability - CVE-2024-7774
- matrix-js-sdk has insufficient MXC URI validation which allows client-side path traversal - CVE-2024-50336
You might also like:
See something that needs correcting? Let us knowUpdated October 08, 2024