---
title: "GHSA-9cp7-j3f8-p5jx: Daptin has Unauthenticated Path Traversal and Zip Slip"
url: https://erroneo.us/security/ghsa/GHSA-9cp7-j3f8-p5jx/
description: "GHSA-9cp7-j3f8-p5jx (critical, Go): Daptin has Unauthenticated Path Traversal and Zip Slip. Impact The cloudstore.file.upload action in…"
type: advisory
section: "Security Digest"
date_published: 2026-04-10
date_modified: 2026-04-10
publisher: erroneo.us
author: erroneo.us Security Desk
ghsa: "GHSA-9cp7-j3f8-p5jx"
license: All rights reserved. Quote with attribution and a link.
---

# GHSA-9cp7-j3f8-p5jx: Daptin has Unauthenticated Path Traversal and Zip Slip

## Affected packages

- Go `github.com/daptin/daptin` <= 0.11.3 → fixed: 0.12.0

## Details

Impact The cloudstore.file.upload action in server/actions/actioncloudstorefileupload.go writes user-supplied filenames directly to disk without proper validation. This allows unauthenticated attackers to perform path traversal and zip slip attacks, leading to arbitrary file write and potential remote code execution. CVSS Score: 10.0 Critical CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H CWE: CWE-22 (Path Traversal) Patches Upgrade to a patched version once released. The vulnerability affects all versions

## Sources

- [GitHub Advisory GHSA-9cp7-j3f8-p5jx](https://github.com/advisories/GHSA-9cp7-j3f8-p5jx)
- [github.com](https://github.com/daptin/daptin/security/advisories/GHSA-9cp7-j3f8-p5jx)
- [github.com](https://github.com/daptin/daptin/commit/8d626bbb14f82160a08cbca53e0749f475f5742c)

---
Source page: https://erroneo.us/security/ghsa/GHSA-9cp7-j3f8-p5jx/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt