Description
A user with admin permission can read arbitrary file and directory names on the filesystem by calling the admin/build-mobile-app/result?build_dir_name= endpoint. The build_dir_name parameter is not properly validated and it’s then used to construct the buildDir that is read. The file/directory names under the buildDir will be returned.
Recommendation
Update the @saltcorn/server package to the latest compatible version. Followings are version details:
- Affected version(s): <= 1.0.0-beta.13
- Patched version(s): 1.0.0-beta.14
References
Could your website be exposed too?
SmartScanner can check your website for @saltcorn/server arbitrary file and directory listing when accessing build mobile app results and gives you actionable findings to investigate.
Start a free scanRelated Issues
- @saltcorn/server arbitrary file zip read and download when downloading auto backups - Vulnerability
- Saltcorn has an Unauthenticated Path Traversal in sync endpoints, allowing arbitrary file write and directory read - CVE-2026-40163
- Saltcorn Server allows logged-in users to delete arbitrary files because of a path traversal vulnerability - CVE-2024-47818
- esbuild allows arbitrary file read when running the development server on Windows - Vulnerability
You might also like:
See something that needs correcting? Let us knowUpdated October 04, 2024