8.2

CVE-2026-40163

Exploit

Saltcorn has an Unauthenticated Path Traversal in sync endpoints allows arbitrary file write and directory read

Saltcorn is an extensible, open source, no-code database application builder. Prior to 1.4.5, 1.5.5, and 1.6.0-beta.4, the POST /sync/offline_changes endpoint allows an unauthenticated attacker to create arbitrary directories and write a changes.json file with attacker-controlled JSON content anywhere on the server filesystem. The GET /sync/upload_finished endpoint allows an unauthenticated attacker to list arbitrary directory contents and read specific JSON files. This vulnerability is fixed in 1.4.5, 1.5.5, and 1.6.0-beta.4.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Saltcorn ≫ Saltcorn Version < 1.4.5
Saltcorn ≫ Saltcorn Version >= 1.5.0 < 1.5.5
Saltcorn ≫ Saltcorn Version 1.6.0 Update alpha0
Saltcorn ≫ Saltcorn Version 1.6.0 Update alpha1
Saltcorn ≫ Saltcorn Version 1.6.0 Update alpha10
Saltcorn ≫ Saltcorn Version 1.6.0 Update alpha11
Saltcorn ≫ Saltcorn Version 1.6.0 Update alpha12
Saltcorn ≫ Saltcorn Version 1.6.0 Update alpha13
Saltcorn ≫ Saltcorn Version 1.6.0 Update alpha14
Saltcorn ≫ Saltcorn Version 1.6.0 Update alpha15
Saltcorn ≫ Saltcorn Version 1.6.0 Update alpha16
Saltcorn ≫ Saltcorn Version 1.6.0 Update alpha17
Saltcorn ≫ Saltcorn Version 1.6.0 Update alpha2
Saltcorn ≫ Saltcorn Version 1.6.0 Update alpha3
Saltcorn ≫ Saltcorn Version 1.6.0 Update alpha4
Saltcorn ≫ Saltcorn Version 1.6.0 Update alpha5
Saltcorn ≫ Saltcorn Version 1.6.0 Update alpha6
Saltcorn ≫ Saltcorn Version 1.6.0 Update alpha7
Saltcorn ≫ Saltcorn Version 1.6.0 Update alpha8
Saltcorn ≫ Saltcorn Version 1.6.0 Update alpha9
Saltcorn ≫ Saltcorn Version 1.6.0 Update beta1
Saltcorn ≫ Saltcorn Version 1.6.0 Update beta2
Saltcorn ≫ Saltcorn Version 1.6.0 Update beta3
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.33% 0.249
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security-advisories@github.com 8.2 3.9 4.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

https://github.com/saltcorn/saltcorn/security/advisories/GHSA-32pv-mpqg-h292
Vendor Advisory
Exploit
Mitigation