Security Digest · Critical advisory (no CVE assigned)
GHSA-9cp7-j3f8-p5jx: Daptin has Unauthenticated Path Traversal and Zip Slip
Impact The cloudstore.file.upload action in server/actions/actioncloudstorefileupload.go writes user-supplied filenames directly to disk without proper validation.
CVSS 10.0 Critical GitHub-reviewed · critical
Should you act?
- Only if you depend on one of the packages below, directly or transitively, in a vulnerable version. Check your lockfile with
govulncheck ./.... - No CVE has been assigned, so it will not appear in CVE-based scanners that ignore GitHub advisories.
npm audit,pip-auditand Dependabot do read GitHub advisories.
Affected packages
| Ecosystem | Package | Vulnerable | First fixed |
|---|---|---|---|
| Go | github.com/daptin/daptin | <= 0.11.3 | 0.12.0 |
Details
Impact The cloudstore.file.upload action in server/actions/actioncloudstorefileupload.go writes user-supplied filenames directly to disk without proper validation.
This allows unauthenticated attackers to perform path traversal and zip slip attacks, leading to arbitrary file write and potential remote code execution.
CVSS Score: 10.0 Critical CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H CWE: CWE-22 (Path Traversal)
Patches
Upgrade to a patched version once released. The vulnerability affects all versions
Workarounds
Restrict access to the cloudstore.file.upload action through authentication and authorization controls until a patch is available.
CVSS: 10.0 (v3.1) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H
Sources and references
- GitHub Advisory GHSA-9cp7-j3f8-p5jx github.com
- github.com github.com
- github.com github.com