Sliver is a command and control framework that uses a custom Wireguard netstack. Prior to 1.6.11, a path traversal in the website content subsystem lets an authenticated operator read arbitrary files on the Sliver server host. This is an authenticated path traversal / arbitrary file read issue, and it can expose credentials, configs, and keys. This vulnerability is fixed in 1.6.11.

Affected: Go: github.com/bishopfox/sliver

## Summary A Path Traversal vulnerability in the website content subsystem lets an authenticated operator read arbitrary files on the Sliver server host. This is an authenticated **Path Traversal / arbitrary file read** issue, and it can expose credentials, configs, and keys.

## Affected Component - Website content management (gRPC): `WebsiteAddContent`, `Website`, `Websites` - Server-side file read in `Website.ToProtobuf`

## Impact - **Arbitrary file read** as the Sliver server OS user. - Exposure of sensitive data such as operator configs, TLS keys, tokens, and logs.

## Root Cause The server accepts and persists arbitrary website paths from the operator, then later reads from disk using that path without sanitization or containment.

## Vulnerable Code References - `server/rpc/rpc-website.go:100` — accepts `content.Path` from operator RPC and persists it via `website.AddContent` - `server/db/models/website.go:52` — reads from disk with `filepath.Join(webContentDir, webcontent.Path)` without validating or constraining `webcontent.Path`

## Proof of Concept (PoC)

### Steps (local test) 1. Build the server: ```bash go build -mod=vendor -tags go_sqlite,server -o sliver-server ./server ``` 2. Create an operator config (permission `all` for website operations): ```bash ./sliver-server operator -n testop -l 127.0.0.1 -p 31337 -P all -o file -s /tmp ``` 3. Start the daemon: ```bash ./sliver-server daemon -l 127.0.0.1 -p 31337 ``` 4. Run the PoC: `…