https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 22:45:29 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-291420 EUVD-2026-291420 https://cve.radiocsirt.org/vuln/euvd-2026-291420 https://cve.radiocsirt.org/vuln/fkie_cve-2026-40163 <p>Saltcorn is an extensible, open source, no-code database application builder. Prior to 1.4.5, 1.5.5, and 1.6.0-beta.4, the POST /sync/offline_changes endpoint allows an unauthenticated attacker to create arbitrary directories and write a changes.json file with attacker-controlled JSON content anywhere on the server filesystem. The GET /sync/upload_finished endpoint allows an unauthenticated attacker to list arbitrary directory contents and read specific JSON files. This vulnerability is fixed in 1.4.5, 1.5.5, and 1.6.0-beta.4.</p> <p>Saltcorn is an extensible, open source, no-code database application builder. Prior to 1.4.5, 1.5.5, and 1.6.0-beta.4, the POST /sync/offline_changes endpoint allows an unauthenticated attacker to create arbitrary directories and write a changes.json file with attacker-controlled JSON content anywhere on the server filesystem. The GET /sync/upload_finished endpoint allows an unauthenticated attacker to list arbitrary directory contents and read specific JSON files. This vulnerability is fixed in 1.4.5, 1.5.5, and 1.6.0-beta.4.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-40163 https://cve.radiocsirt.org/vuln/ghsa-32pv-mpqg-h292 <p><strong>Affected:</strong> npm: @saltcorn/server</p> <p>### Summary</p> <p>Two unauthenticated path traversal vulnerabilities exist in Saltcorn&#39;s mobile sync endpoints. The `POST /sync/offline_changes` endpoint allows an unauthenticated attacker to create arbitrary directories and write a `changes.json` file with attacker-controlled JSON content anywhere on the server filesystem. The `GET /sync/upload_finished` endpoint allows an unauthenticated attacker to list arbitrary directory contents and read specific JSON files.</p> <p>The safe path validation function `File.normalise_in_base()` exists in the codebase and is correctly used by the `clean_sync_dir` endpoint in the **same file** (fix for GHSA-43f3-h63w-p6f6), but was not applied to these two endpoints.</p> <p>### Details</p> <p>**Finding 1: Arbitrary file write — `POST /sync/offline_changes` (sync.js line 226)**</p> <p>The `newSyncTimestamp` parameter from the request body is used directly in `path.join()` without sanitization:</p> <p>```javascript const syncDirName = `${newSyncTimestamp}_${req.user?.email || &#34;public&#34;}`; const syncDir = path.join( rootFolder.location, &#34;mobile_app&#34;, &#34;sync&#34;, syncDirName ); await fs.mkdir(syncDir, { recursive: true }); // creates arbitrary dir await fs.writeFile( path.join(syncDir, &#34;changes.json&#34;), JSON.stringify(changes) // writes attacker content ); ```</p> <p>No authentication middleware is applied to this route. Since `path.join()` normalizes `../` sequences, setting `newSyncTimestamp` to `../../../../tmp/evil` causes the path to resolve…</p> <p><strong>Affected:</strong> npm: @saltcorn/server</p> <p>### Summary</p> <p>Two unauthenticated path traversal vulnerabilities exist in Saltcorn&#39;s mobile sync endpoints. The `POST /sync/offline_changes` endpoint allows an unauthenticated attacker to create arbitrary directories and write a `changes.json` file with attacker-controlled JSON content anywhere on the server filesystem. The `GET /sync/upload_finished` endpoint allows an unauthenticated attacker to list arbitrary directory contents and read specific JSON files.</p> <p>The safe path validation function `File.normalise_in_base()` exists in the codebase and is correctly used by the `clean_sync_dir` endpoint in the **same file** (fix for GHSA-43f3-h63w-p6f6), but was not applied to these two endpoints.</p> <p>### Details</p> <p>**Finding 1: Arbitrary file write — `POST /sync/offline_changes` (sync.js line 226)**</p> <p>The `newSyncTimestamp` parameter from the request body is used directly in `path.join()` without sanitization:</p> <p>```javascript const syncDirName = `${newSyncTimestamp}_${req.user?.email || &#34;public&#34;}`; const syncDir = path.join( rootFolder.location, &#34;mobile_app&#34;, &#34;sync&#34;, syncDirName ); await fs.mkdir(syncDir, { recursive: true }); // creates arbitrary dir await fs.writeFile( path.join(syncDir, &#34;changes.json&#34;), JSON.stringify(changes) // writes attacker content ); ```</p> <p>No authentication middleware is applied to this route. Since `path.join()` normalizes `../` sequences, setting `newSyncTimestamp` to `../../../../tmp/evil` causes the path to resolve…</p> https://cve.radiocsirt.org/vuln/ghsa-32pv-mpqg-h292