CWE-22
Allowed-with-ReviewImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Abstraction: Base · Status: Stable
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
15153 vulnerabilities reference this CWE, most recent first.
GHSA-VVCG-F4WP-C6QR
Vulnerability from github – Published: 2026-08-18 12:31 – Updated: 2026-08-18 12:31ArcadeDB versions before 26.8.1 fail to sanitize database names in the POST /api/v1/server endpoint's create database and drop database commands, allowing authenticated root users to write and delete arbitrary files outside the configured database directory. Attackers can supply database names containing ../ sequences to create databases at arbitrary filesystem paths or recursively delete directories the server process can access.
{
"affected": [],
"aliases": [
"CVE-2026-75855"
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-18T12:19:35Z",
"severity": "HIGH"
},
"details": "ArcadeDB versions before 26.8.1 fail to sanitize database names in the POST /api/v1/server endpoint\u0027s create database and drop database commands, allowing authenticated root users to write and delete arbitrary files outside the configured database directory. Attackers can supply database names containing ../ sequences to create databases at arbitrary filesystem paths or recursively delete directories the server process can access.",
"id": "GHSA-vvcg-f4wp-c6qr",
"modified": "2026-08-18T12:31:23Z",
"published": "2026-08-18T12:31:23Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-qwgr-2c45-63xx"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75855"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/arcadedb-before-path-traversal-via-create-drop-database"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-VVF6-QQ84-65H3
Vulnerability from github – Published: 2022-05-24 16:43 – Updated: 2024-04-04 00:01The Cprime Power Scripts app before 4.0.14 for Atlassian Jira allows Directory Traversal.
{
"affected": [],
"aliases": [
"CVE-2019-9005"
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-04-18T18:29:00Z",
"severity": "MODERATE"
},
"details": "The Cprime Power Scripts app before 4.0.14 for Atlassian Jira allows Directory Traversal.",
"id": "GHSA-vvf6-qq84-65h3",
"modified": "2024-04-04T00:01:43Z",
"published": "2022-05-24T16:43:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9005"
},
{
"type": "WEB",
"url": "https://marketplace.atlassian.com/apps/43318/power-scripts-jira-script-automation/version-history"
},
{
"type": "WEB",
"url": "https://www.detack.de/en/cve-2019-9005"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-VVGP-XHGP-QCMR
Vulnerability from github – Published: 2022-05-17 05:50 – Updated: 2022-05-17 05:50Directory traversal vulnerability in the Ternaria Informatica JProject Manager (com_jprojectmanager) component 1.0 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.
{
"affected": [],
"aliases": [
"CVE-2010-1469"
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2010-04-19T19:30:00Z",
"severity": "MODERATE"
},
"details": "Directory traversal vulnerability in the Ternaria Informatica JProject Manager (com_jprojectmanager) component 1.0 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.",
"id": "GHSA-vvgp-xhgp-qcmr",
"modified": "2022-05-17T05:50:16Z",
"published": "2022-05-17T05:50:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-1469"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.org/1004-exploits/joomlajprojectmanager-lfi.txt"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/39282"
},
{
"type": "WEB",
"url": "http://www.exploit-db.com/exploits/12146"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/39383"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-VVHJ-8W7X-QJ58
Vulnerability from github – Published: 2022-05-24 19:11 – Updated: 2025-10-22 00:32Affected versions of Atlassian Jira Server and Data Center allow remote attackers to read particular files via a path traversal vulnerability in the /WEB-INF/web.xml endpoint. The affected versions are before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1.
{
"affected": [],
"aliases": [
"CVE-2021-26086"
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-08-16T01:15:00Z",
"severity": "MODERATE"
},
"details": "Affected versions of Atlassian Jira Server and Data Center allow remote attackers to read particular files via a path traversal vulnerability in the /WEB-INF/web.xml endpoint. The affected versions are before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1.",
"id": "GHSA-vvhj-8w7x-qj58",
"modified": "2025-10-22T00:32:19Z",
"published": "2022-05-24T19:11:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-26086"
},
{
"type": "WEB",
"url": "https://jira.atlassian.com/browse/JRASERVER-72695"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-26086"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/164405/Atlassian-Jira-Server-Data-Center-8.4.0-File-Read.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-VVHX-467P-5WJQ
Vulnerability from github – Published: 2025-01-14 18:31 – Updated: 2025-01-14 18:31A vulnerability has been found in Shanghai Lingdang Information Technology Lingdang CRM up to 8.6.0.0 and classified as problematic. This vulnerability affects unknown code of the file /crm/weixinmp/index.php?userid=123&module=Users&usid=1&action=UsersAjax&minipro_const_type=1&related_module=Singin. The manipulation of the argument pathfile leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
{
"affected": [],
"aliases": [
"CVE-2025-0461"
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-14T16:15:34Z",
"severity": "MODERATE"
},
"details": "A vulnerability has been found in Shanghai Lingdang Information Technology Lingdang CRM up to 8.6.0.0 and classified as problematic. This vulnerability affects unknown code of the file /crm/weixinmp/index.php?userid=123\u0026module=Users\u0026usid=1\u0026action=UsersAjax\u0026minipro_const_type=1\u0026related_module=Singin. The manipulation of the argument pathfile leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-vvhx-467p-5wjq",
"modified": "2025-01-14T18:31:59Z",
"published": "2025-01-14T18:31:58Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0461"
},
{
"type": "WEB",
"url": "https://github.com/BxYQ/ld/blob/main/downloadSocialPromotionQrcode_fileread.doc"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.291478"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.291478"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.474252"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-VVJ2-P425-QPHV
Vulnerability from github – Published: 2024-07-30 00:34 – Updated: 2024-07-30 00:34Comodo Internet Security Pro Directory Traversal Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Comodo Internet Security Pro. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the update mechanism. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-19055.
{
"affected": [],
"aliases": [
"CVE-2024-7248"
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-29T22:15:05Z",
"severity": "HIGH"
},
"details": "Comodo Internet Security Pro Directory Traversal Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Comodo Internet Security Pro. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the update mechanism. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-19055.",
"id": "GHSA-vvj2-p425-qphv",
"modified": "2024-07-30T00:34:24Z",
"published": "2024-07-30T00:34:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7248"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-953"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-VVJP-Q62M-2VPH
Vulnerability from github – Published: 2023-11-09 18:34 – Updated: 2023-11-17 18:30The filepath package does not recognize paths with a \??\ prefix as special. On Windows, a path beginning with \??\ is a Root Local Device path equivalent to a path beginning with \?. Paths with a \??\ prefix may be used to access arbitrary locations on the system. For example, the path \??\c:\x is equivalent to the more common path c:\x. Before fix, Clean could convert a rooted path such as \a..\??\b into the root local device path \??\b. Clean will now convert this to .\??\b. Similarly, Join(\, ??, b) could convert a seemingly innocent sequence of path elements into the root local device path \??\b. Join will now convert this to .\??\b. In addition, with fix, IsAbs now correctly reports paths beginning with \??\ as absolute, and VolumeName correctly reports the \??\ prefix as a volume name.
{
"affected": [],
"aliases": [
"CVE-2023-45283"
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-11-09T17:15:08Z",
"severity": "HIGH"
},
"details": "The filepath package does not recognize paths with a \\??\\ prefix as special. On Windows, a path beginning with \\??\\ is a Root Local Device path equivalent to a path beginning with \\\\?\\. Paths with a \\??\\ prefix may be used to access arbitrary locations on the system. For example, the path \\??\\c:\\x is equivalent to the more common path c:\\x. Before fix, Clean could convert a rooted path such as \\a\\..\\??\\b into the root local device path \\??\\b. Clean will now convert this to .\\??\\b. Similarly, Join(\\, ??, b) could convert a seemingly innocent sequence of path elements into the root local device path \\??\\b. Join will now convert this to \\.\\??\\b. In addition, with fix, IsAbs now correctly reports paths beginning with \\??\\ as absolute, and VolumeName correctly reports the \\??\\ prefix as a volume name.",
"id": "GHSA-vvjp-q62m-2vph",
"modified": "2023-11-17T18:30:49Z",
"published": "2023-11-09T18:34:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45283"
},
{
"type": "WEB",
"url": "https://go.dev/cl/540277"
},
{
"type": "WEB",
"url": "https://go.dev/cl/541175"
},
{
"type": "WEB",
"url": "https://go.dev/issue/63713"
},
{
"type": "WEB",
"url": "https://go.dev/issue/64028"
},
{
"type": "WEB",
"url": "https://groups.google.com/g/golang-announce/c/4tU8LZfBFkY"
},
{
"type": "WEB",
"url": "https://groups.google.com/g/golang-dev/c/6ypN5EjibjM/m/KmLVYH_uAgAJ"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2023-2185"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20231214-0008"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2023/12/05/2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-VVMV-J82J-96CM
Vulnerability from github – Published: 2025-10-30 21:30 – Updated: 2025-10-30 21:30IBM Tivoli Monitoring 6.3.0.7 through 6.3.0.7 Service Pack 21 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.
{
"affected": [],
"aliases": [
"CVE-2025-3355"
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-30T20:15:38Z",
"severity": "HIGH"
},
"details": "IBM Tivoli Monitoring 6.3.0.7 through 6.3.0.7 Service Pack 21 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing \"dot dot\" sequences (/../) to view arbitrary files on the system.",
"id": "GHSA-vvmv-j82j-96cm",
"modified": "2025-10-30T21:30:46Z",
"published": "2025-10-30T21:30:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3355"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7249694"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-VVMV-WRVP-9GJR
Vulnerability from github – Published: 2024-07-15 17:46 – Updated: 2024-07-15 21:38Summary
When trying to add a BLOCK_LIST feature when the maintainer noticed they didn't sanitize the ImageId in the code, which leads to path traversal vulnerability. Now, this is different from a traditional path traversal issue, because as of NOW you can store the image in any place arbitrarily, and given enough time they might be able to come up with a working exploit BUT for the time being they am reporting this.
Details
@jmondi/url-to-png does not sanitizing the ImageID as in not removing special chars from the params (extract_query_params.ts#l75)
const imageId = dateString + "." + slugify(validData.url) +configToString(params);
This when fed to other parts of the code such as (filesystem.ts#L34)
return path.join(this.storagePath, imageId) + ".png";
Would result in path traversal issue.
PoC
# Configuration for filesystem storage provider (optional)
STORAGE_PROVIDER=filesystem
IMAGE_STORAGE_PATH=poc
Set this in your .env file and use this as your payload.
http://localhost:3089/?url=http://example.com&width=400&isDarkMode=../../../../../../../../../../../../tmp/hack
This will create a .png file in the /tmp section of the system.
Loom POC: https://www.loom.com/share/bd7b306cdae7445c97e68f0626e743a6
This is valid for pretty much all the arguments (except for numeric values)
A simple fix would be to use the slugify for the params as well like so (#L75)
- const imageId = dateString + "." + slugify(validData.url) + configToString(params);
+ const imageId = dateString + "." + slugify(validData.url) + slugify(configToString(params));
Impact
This would be path traversal vulnerability which allows arbitrary write as of now.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@jmondi/url-to-png"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.1.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-39918"
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"github_reviewed": true,
"github_reviewed_at": "2024-07-15T17:46:57Z",
"nvd_published_at": "2024-07-15T20:15:04Z",
"severity": "MODERATE"
},
"details": "### Summary\nWhen trying to add a `BLOCK_LIST` feature when the maintainer noticed they didn\u0027t sanitize the `ImageId` in the code, which leads to path traversal vulnerability. Now, this is different from a traditional path traversal issue, because as of NOW you can store the image in any place arbitrarily, and given enough time they might be able to come up with a working exploit BUT for the time being they am reporting this. \n\n### Details\n\n@jmondi/url-to-png does not sanitizing the `ImageID` as in not removing special chars from the params [(extract_query_params.ts#l75)](https://github.com/jasonraimondi/url-to-png/blob/e43098e0af3a380ebc044e7f303a83933b94b434/src/middlewares/extract_query_params.ts#L75)\n\n```js\nconst imageId = dateString + \".\" + slugify(validData.url) +configToString(params);\n```\n\nThis when fed to other parts of the code such as ([filesystem.ts#L34](https://github.com/jasonraimondi/url-to-png/blob/8afc00247c1d7e6c7b37356a5f6282b486e596fa/src/lib/storage/filesystem.ts#L34))\n\n```js\nreturn path.join(this.storagePath, imageId) + \".png\";\n```\n\nWould result in path traversal issue. \n\n### PoC\n\n```\n# Configuration for filesystem storage provider (optional)\nSTORAGE_PROVIDER=filesystem\nIMAGE_STORAGE_PATH=poc\n```\n\nSet this in your `.env` file and use this as your payload. \n\n```\nhttp://localhost:3089/?url=http://example.com\u0026width=400\u0026isDarkMode=../../../../../../../../../../../../tmp/hack\n```\n\nThis will create a `.png` file in the `/tmp` section of the system.\n\nLoom POC: https://www.loom.com/share/bd7b306cdae7445c97e68f0626e743a6 \n\n\n\nThis is valid for pretty much all the arguments (except for numeric values)\n\nA simple fix would be to use the `slugify` for the params as well like so ([#L75](https://github.com/jasonraimondi/url-to-png/blob/e43098e0af3a380ebc044e7f303a83933b94b434/src/middlewares/extract_query_params.ts#L75))\n\n```diff\n- const imageId = dateString + \".\" + slugify(validData.url) + configToString(params);\n+ const imageId = dateString + \".\" + slugify(validData.url) + slugify(configToString(params));\n```\n\n\n### Impact\nThis would be path traversal vulnerability which allows arbitrary write as of now. \n",
"id": "GHSA-vvmv-wrvp-9gjr",
"modified": "2024-07-15T21:38:34Z",
"published": "2024-07-15T17:46:57Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/jasonraimondi/url-to-png/security/advisories/GHSA-vvmv-wrvp-9gjr"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39918"
},
{
"type": "WEB",
"url": "https://github.com/jasonraimondi/url-to-png/commit/e4eaeca6493b21cd515b582fd6c0af09ede54507"
},
{
"type": "PACKAGE",
"url": "https://github.com/jasonraimondi/url-to-png"
},
{
"type": "WEB",
"url": "https://github.com/jasonraimondi/url-to-png/blob/e43098e0af3a380ebc044e7f303a83933b94b434/src/middlewares/extract_query_params.ts#L75"
},
{
"type": "WEB",
"url": "https://github.com/jasonraimondi/url-to-png/releases/tag/v2.1.2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "@jmondi/url-to-png contains a Path Traversal vulnerability"
}
GHSA-VVP7-H4FJ-M28W
Vulnerability from github – Published: 2026-07-31 22:35 – Updated: 2026-07-31 22:35Summary
The subtitlesHandler endpoint (GET /api/media/subtitles) accepts two user-controlled query parameters: path and name, both of which are used in filesystem operations without sanitization, creating two independent path traversal vectors.
The primary vector is the path parameter: it is passed directly to idx.GetRealPath() without calling SanitizeUserPath(), allowing an attacker to escape the storage root and set parentDir to any directory on the host. No existing anchor file is required.
The secondary vector is the name parameter: it is joined with parentDir via filepath.Join(parentDir, name) without stripping directory components, allowing traversal relative to any resolved parentDir.
Any authenticated user (regardless of role or permissions) can exploit either vector to read any text file readable by the server process, including /etc/passwd, SSH keys, database credentials, and JWT signing keys.
Details
1. path parameter lacks SanitizeUserPath() — primary vector (http/media.go:54)
userscope, err := d.user.GetScopeForSourceName(source)
// ...
realPath, _, err := idx.GetRealPath(userscope, path) // path is raw user input, no sanitization
// ...
parentDir := filepath.Dir(realPath) // line 59: attacker controls this directory
SanitizeUserPath() explicitly rejects .. segments:
func SanitizeUserPath(userPath string) (string, error) {
// ...
for _, segment := range segments {
if segment == ".." {
return "", fmt.Errorf("invalid path: path traversal detected")
}
}
// ...
}
Every other handler in the codebase calls SanitizeUserPath() before GetRealPath(). This handler skips it, so path=../../etc/passwd resolves parentDir to /etc, with no anchor file required.
2. name parameter used directly in filepath.Join — secondary vector (http/media.go:63)
name := r.URL.Query().Get("name") // line 37 — raw user input
// ...
content, err = utils.GetSubtitleSidecarContent(
filepath.Join(parentDir, name)) // line 63 — TRAVERSAL
filepath.Join(parentDir, "../../etc/passwd") resolves the .. components, escaping parentDir. This vector requires a valid file in scope as the path anchor.
3. GetSubtitleSidecarContent reads and returns file contents (common/utils/media.go:17-43)
func GetSubtitleSidecarContent(subtitlePath string) (string, error) {
info, err := os.Stat(subtitlePath) // follows the traversed path
// size check: < 50MB
isText, err := IsTextFile(subtitlePath) // checks UTF-8 validity
content, err := os.ReadFile(subtitlePath) // reads and returns content
return string(content), nil
}
The only constraint is that the target file must be UTF-8 valid and under 50MB. Binary files silently return an empty string.
4. Endpoint is behind withUser but requires no special permissions
// httpRouter.go
api.HandleFunc("GET /media/subtitles", withUser(subtitlesHandler))
Any authenticated user can access this endpoint: no admin, modify, share, or download permission is required.
PoC
Vector 1: path traversal (no anchor file needed):
docker run -d --name filebrowser-q-lab -p 18080:80 gtstef/filebrowser:latest && sleep 3
TOKEN=$(curl -s -X POST "http://localhost:18080/api/auth/login?username=admin" -H "X-Password: admin" | tr -d '"')
curl "http://localhost:18080/api/media/subtitles?path=../../etc/passwd&source=srv&name=passwd&embedded=false&auth=$TOKEN"
Expected output: /etc/passwd contents with HTTP 200.
Vector 2: name traversal (anchor file required):
mkdir -p /tmp/fbq-srv && echo "dummy" > /tmp/fbq-srv/poc.txt
docker run -d --name filebrowser-q-lab2 -p 18081:80 -v /tmp/fbq-srv:/srv gtstef/filebrowser:latest && sleep 3
TOKEN=$(curl -s -X POST "http://localhost:18081/api/auth/login?username=admin" -H "X-Password: admin" | tr -d '"')
curl "http://localhost:18081/api/media/subtitles?path=/poc.txt&source=srv&name=../../etc/passwd&embedded=false&auth=$TOKEN"
Expected output: /etc/passwd contents with HTTP 200.
Impact
- Arbitrary file read: Any authenticated user can read any text file on the host filesystem that the server process has read permission for.
- No anchor file required: The
pathvector works on a default install with an empty storage root, so no existing file in scope is needed. - Scope bypass: Scoped users (restricted to a subdirectory) can escape their scope via either vector and access files belonging to other users or the host system.
- Credential exposure:
/etc/passwd,/etc/shadow(if running as root), SSH private keys, application configuration files with database passwords, API keys, and JWT signing secrets. - Privilege escalation: Reading the JWT signing key from the database or config file enables forging admin tokens.
- No special permissions required: The endpoint only requires basic authentication: no admin, modify, share, or download permissions.
Recommended Fix
Apply SanitizeUserPath() to the path parameter and filepath.Base() to the name parameter:
// http/media.go, subtitlesHandler
// Sanitize path parameter (like all other handlers)
path, err := utils.SanitizeUserPath(path)
if err != nil {
return http.StatusBadRequest, err
}
// Strip directory components from name to prevent traversal
name = filepath.Base(name)
SanitizeUserPath() rejects any .. segment. filepath.Base("../../etc/passwd") returns "passwd", preventing traversal via name. Additionally, consider adding a file extension allowlist to restrict name to subtitle formats (.srt, .vtt, .ass, .ssa, .sub) only.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/gtsteffaniak/filebrowser/backend"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.0.0-20260608182036-f3f4bbe80cb5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-54910"
],
"database_specific": {
"cwe_ids": [
"CWE-22",
"CWE-23"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-31T22:35:05Z",
"nvd_published_at": "2026-07-20T15:16:43Z",
"severity": "HIGH"
},
"details": "### Summary\n\nThe `subtitlesHandler` endpoint (`GET /api/media/subtitles`) accepts two user-controlled query parameters: `path` and `name`, both of which are used in filesystem operations without sanitization, creating two independent path traversal vectors.\n\nThe primary vector is the `path` parameter: it is passed directly to `idx.GetRealPath()` without calling `SanitizeUserPath()`, allowing an attacker to escape the storage root and set `parentDir` to any directory on the host. No existing anchor file is required. \n\nThe secondary vector is the `name` parameter: it is joined with `parentDir` via `filepath.Join(parentDir, name)` without stripping directory components, allowing traversal relative to any resolved `parentDir`.\n\nAny authenticated user (regardless of role or permissions) can exploit either vector to read any text file readable by the server process, including `/etc/passwd`, SSH keys, database credentials, and JWT signing keys.\n\n### Details\n\n**1. `path` parameter lacks `SanitizeUserPath()` \u2014 primary vector (`http/media.go:54`)**\n\n```go\nuserscope, err := d.user.GetScopeForSourceName(source)\n// ...\nrealPath, _, err := idx.GetRealPath(userscope, path) // path is raw user input, no sanitization\n// ...\nparentDir := filepath.Dir(realPath) // line 59: attacker controls this directory\n```\n\n`SanitizeUserPath()` explicitly rejects `..` segments:\n\n```go\nfunc SanitizeUserPath(userPath string) (string, error) {\n // ...\n for _, segment := range segments {\n if segment == \"..\" {\n return \"\", fmt.Errorf(\"invalid path: path traversal detected\")\n }\n }\n // ...\n}\n```\n\nEvery other handler in the codebase calls `SanitizeUserPath()` before `GetRealPath()`. This handler skips it, so `path=../../etc/passwd` resolves `parentDir` to `/etc`, with no anchor file required.\n\n**2. `name` parameter used directly in `filepath.Join` \u2014 secondary vector (`http/media.go:63`)**\n\n```go\nname := r.URL.Query().Get(\"name\") // line 37 \u2014 raw user input\n// ...\ncontent, err = utils.GetSubtitleSidecarContent(\n filepath.Join(parentDir, name)) // line 63 \u2014 TRAVERSAL\n```\n\n`filepath.Join(parentDir, \"../../etc/passwd\")` resolves the `..` components, escaping `parentDir`. This vector requires a valid file in scope as the `path` anchor.\n\n**3. `GetSubtitleSidecarContent` reads and returns file contents (`common/utils/media.go:17-43`)**\n\n```go\nfunc GetSubtitleSidecarContent(subtitlePath string) (string, error) {\n info, err := os.Stat(subtitlePath) // follows the traversed path\n // size check: \u003c 50MB\n isText, err := IsTextFile(subtitlePath) // checks UTF-8 validity\n content, err := os.ReadFile(subtitlePath) // reads and returns content\n return string(content), nil\n}\n```\n\nThe only constraint is that the target file must be UTF-8 valid and under 50MB. Binary files silently return an empty string.\n\n**4. Endpoint is behind `withUser` but requires no special permissions**\n\n```go\n// httpRouter.go\napi.HandleFunc(\"GET /media/subtitles\", withUser(subtitlesHandler))\n```\n\nAny authenticated user can access this endpoint: no admin, modify, share, or download permission is required.\n\n### PoC\n\n**Vector 1: `path` traversal (no anchor file needed):**\n\n```bash\ndocker run -d --name filebrowser-q-lab -p 18080:80 gtstef/filebrowser:latest \u0026\u0026 sleep 3\nTOKEN=$(curl -s -X POST \"http://localhost:18080/api/auth/login?username=admin\" -H \"X-Password: admin\" | tr -d \u0027\"\u0027)\ncurl \"http://localhost:18080/api/media/subtitles?path=../../etc/passwd\u0026source=srv\u0026name=passwd\u0026embedded=false\u0026auth=$TOKEN\"\n```\n**Expected output:** `/etc/passwd` contents with HTTP 200.\n\n**Vector 2: `name` traversal (anchor file required):**\n\n```bash\nmkdir -p /tmp/fbq-srv \u0026\u0026 echo \"dummy\" \u003e /tmp/fbq-srv/poc.txt\ndocker run -d --name filebrowser-q-lab2 -p 18081:80 -v /tmp/fbq-srv:/srv gtstef/filebrowser:latest \u0026\u0026 sleep 3\nTOKEN=$(curl -s -X POST \"http://localhost:18081/api/auth/login?username=admin\" -H \"X-Password: admin\" | tr -d \u0027\"\u0027)\ncurl \"http://localhost:18081/api/media/subtitles?path=/poc.txt\u0026source=srv\u0026name=../../etc/passwd\u0026embedded=false\u0026auth=$TOKEN\"\n```\n**Expected output:** `/etc/passwd` contents with HTTP 200.\n\n### Impact\n\n- **Arbitrary file read**: Any authenticated user can read any text file on the host filesystem that the server process has read permission for.\n- **No anchor file required**: The `path` vector works on a default install with an empty storage root, so no existing file in scope is needed.\n- **Scope bypass**: Scoped users (restricted to a subdirectory) can escape their scope via either vector and access files belonging to other users or the host system.\n- **Credential exposure**: `/etc/passwd`, `/etc/shadow` (if running as root), SSH private keys, application configuration files with database passwords, API keys, and JWT signing secrets.\n- **Privilege escalation**: Reading the JWT signing key from the database or config file enables forging admin tokens.\n- **No special permissions required**: The endpoint only requires basic authentication: no admin, modify, share, or download permissions.\n\n### Recommended Fix\n\nApply `SanitizeUserPath()` to the `path` parameter and `filepath.Base()` to the `name` parameter:\n\n```go\n// http/media.go, subtitlesHandler\n\n// Sanitize path parameter (like all other handlers)\npath, err := utils.SanitizeUserPath(path)\nif err != nil {\n return http.StatusBadRequest, err\n}\n\n// Strip directory components from name to prevent traversal\nname = filepath.Base(name)\n```\n\n`SanitizeUserPath()` rejects any `..` segment. `filepath.Base(\"../../etc/passwd\")` returns `\"passwd\"`, preventing traversal via `name`. Additionally, consider adding a file extension allowlist to restrict `name` to subtitle formats (`.srt`, `.vtt`, `.ass`, `.ssa`, `.sub`) only.",
"id": "GHSA-vvp7-h4fj-m28w",
"modified": "2026-07-31T22:35:05Z",
"published": "2026-07-31T22:35:05Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-vvp7-h4fj-m28w"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54910"
},
{
"type": "WEB",
"url": "https://github.com/gtsteffaniak/filebrowser/pull/2524"
},
{
"type": "WEB",
"url": "https://github.com/gtsteffaniak/filebrowser/commit/f3f4bbe80cb569d664174aea874d7bfa008c3b5a"
},
{
"type": "PACKAGE",
"url": "https://github.com/gtsteffaniak/filebrowser"
},
{
"type": "WEB",
"url": "https://github.com/gtsteffaniak/filebrowser/releases/tag/v1.4.3-beta"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "FileBrowser Quantum\u0027s path traversal issue in subtitle handler allows any authenticated user to read arbitrary files"
}
Mitigation MIT-5.1
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
- When validating filenames, use stringent allowlists that limit the character set to be used. If feasible, only allow a single "." character in the filename to avoid weaknesses such as CWE-23, and exclude directory separators such as "/" to avoid CWE-36. Use a list of allowable file extensions, which will help to avoid CWE-434.
- Do not rely exclusively on a filtering mechanism that removes potentially dangerous characters. This is equivalent to a denylist, which may be incomplete (CWE-184). For example, filtering "/" is insufficient protection if the filesystem also supports the use of "\" as a directory separator. Another possible error could occur when the filtering is applied in a way that still produces dangerous data (CWE-182). For example, if "../" sequences are removed from the ".../...//" string in a sequential fashion, two instances of "../" would be removed from the original string, but the remaining characters would still form the "../" string.
Mitigation MIT-15
For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
Mitigation MIT-20.1
Strategy: Input Validation
- Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.
- Use a built-in path canonicalization function (such as realpath() in C) that produces the canonical version of the pathname, which effectively removes ".." sequences and symbolic links (CWE-23, CWE-59). This includes:
- realpath() in C
- getCanonicalPath() in Java
- GetFullPath() in ASP.NET
- realpath() or abs_path() in Perl
- realpath() in PHP
Mitigation MIT-4
Strategy: Libraries or Frameworks
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].
Mitigation MIT-29
Strategy: Firewall
Use an application firewall that can detect attacks against this weakness. It can be beneficial in cases in which the code cannot be fixed (because it is controlled by a third party), as an emergency prevention measure while more comprehensive software assurance measures are applied, or to provide defense in depth [REF-1481].
Mitigation MIT-17
Strategy: Environment Hardening
Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.
Mitigation MIT-21.1
Strategy: Enforcement by Conversion
- When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs.
- For example, ID 1 could map to "inbox.txt" and ID 2 could map to "profile.txt". Features such as the ESAPI AccessReferenceMap [REF-185] provide this capability.
Mitigation MIT-22
Strategy: Sandbox or Jail
- Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by the software.
- OS-level examples include the Unix chroot jail, AppArmor, and SELinux. In general, managed code may provide some protection. For example, java.io.FilePermission in the Java SecurityManager allows the software to specify restrictions on file operations.
- This may not be a feasible solution, and it only limits the impact to the operating system; the rest of the application may still be subject to compromise.
- Be careful to avoid CWE-243 and other weaknesses related to jails.
Mitigation MIT-34
Strategy: Attack Surface Reduction
- Store library, include, and utility files outside of the web document root, if possible. Otherwise, store them in a separate directory and use the web server's access control capabilities to prevent attackers from directly requesting them. One common practice is to define a fixed constant in each calling program, then check for the existence of the constant in the library/include file; if the constant does not exist, then the file was directly requested, and it can exit immediately.
- This significantly reduces the chance of an attacker being able to bypass any protection mechanisms that are in the base program but not in the include files. It will also reduce the attack surface.
Mitigation MIT-39
- Ensure that error messages only contain minimal details that are useful to the intended audience and no one else. The messages need to strike the balance between being too cryptic (which can confuse users) or being too detailed (which may reveal more than intended). The messages should not reveal the methods that were used to determine the error. Attackers can use detailed information to refine or optimize their original attack, thereby increasing their chances of success.
- If errors must be captured in some detail, record them in log messages, but consider what could occur if the log messages can be viewed by attackers. Highly sensitive information such as passwords should never be saved to log files.
- Avoid inconsistent messaging that might accidentally tip off an attacker about internal state, such as whether a user account exists or not.
- In the context of path traversal, error messages which disclose path information can help attackers craft the appropriate attack strings to move through the file system hierarchy.
Mitigation MIT-16
Strategy: Environment Hardening
When using PHP, configure the application so that it does not use register_globals. During implementation, develop the application so that it does not rely on this feature, but be wary of implementing a register_globals emulation that is subject to weaknesses such as CWE-95, CWE-621, and similar issues.
CAPEC-126: Path Traversal
An adversary uses path manipulation methods to exploit insufficient input validation of a target to obtain access to data that should be not be retrievable by ordinary well-formed requests. A typical variety of this attack involves specifying a path to a desired file together with dot-dot-slash characters, resulting in the file access API or function traversing out of the intended directory structure and into the root file system. By replacing or modifying the expected path information the access function or API retrieves the file desired by the attacker. These attacks either involve the attacker providing a complete path to a targeted file or using control characters (e.g. path separators (/ or \) and/or dots (.)) to reach desired directories or files.
CAPEC-64: Using Slashes and URL Encoding Combined to Bypass Validation Logic
This attack targets the encoding of the URL combined with the encoding of the slash characters. An attacker can take advantage of the multiple ways of encoding a URL and abuse the interpretation of the URL. A URL may contain special character that need special syntax handling in order to be interpreted. Special characters are represented using a percentage character followed by two digits representing the octet code of the original character (%HEX-CODE). For instance US-ASCII space character would be represented with %20. This is often referred as escaped ending or percent-encoding. Since the server decodes the URL from the requests, it may restrict the access to some URL paths by validating and filtering out the URL requests it received. An attacker will try to craft an URL with a sequence of special characters which once interpreted by the server will be equivalent to a forbidden URL. It can be difficult to protect against this attack since the URL can contain other format of encoding such as UTF-8 encoding, Unicode-encoding, etc.
CAPEC-76: Manipulating Web Input to File System Calls
An attacker manipulates inputs to the target software which the target software passes to file system calls in the OS. The goal is to gain access to, and perhaps modify, areas of the file system that the target software did not intend to be accessible.
CAPEC-78: Using Escaped Slashes in Alternate Encoding
This attack targets the use of the backslash in alternate encoding. An adversary can provide a backslash as a leading character and causes a parser to believe that the next character is special. This is called an escape. By using that trick, the adversary tries to exploit alternate ways to encode the same character which leads to filter problems and opens avenues to attack.
CAPEC-79: Using Slashes in Alternate Encoding
This attack targets the encoding of the Slash characters. An adversary would try to exploit common filtering problems related to the use of the slashes characters to gain access to resources on the target host. Directory-driven systems, such as file systems and databases, typically use the slash character to indicate traversal between directories or other container components. For murky historical reasons, PCs (and, as a result, Microsoft OSs) choose to use a backslash, whereas the UNIX world typically makes use of the forward slash. The schizophrenic result is that many MS-based systems are required to understand both forms of the slash. This gives the adversary many opportunities to discover and abuse a number of common filtering problems. The goal of this pattern is to discover server software that only applies filters to one version, but not the other.