Description
A user with admin permission can read and download arbitrary zip files when downloading auto backups. The file name used to identify the zip file is not properly sanitized when passed to res.download API.
Recommendation
Update the @saltcorn/server package to the latest compatible version. Followings are version details:
- Affected version(s): <= 1.0.0-beta.13
- Patched version(s): 1.0.0-beta.14
References
Could your website be exposed too?
SmartScanner can check your website for @saltcorn/server arbitrary file zip read and download when downloading auto backups and gives you actionable findings to investigate.
Start a free scanRelated Issues
- @saltcorn/server arbitrary file and directory listing when accessing build mobile app results - Vulnerability
- esbuild allows arbitrary file read when running the development server on Windows - Vulnerability
- Saltcorn has an Unauthenticated Path Traversal in sync endpoints, allowing arbitrary file write and directory read - CVE-2026-40163
- Saltcorn Server allows logged-in users to delete arbitrary files because of a path traversal vulnerability - CVE-2024-47818
You might also like:
See something that needs correcting? Let us knowUpdated October 04, 2024