Saltcorn hat eine Unauthentifizierte Pfadüberschreitung in Sync-Endpunkten, die das Schreiben beliebiger Dateien und das Lesen beliebiger Verzeichnisse ermöglicht

The impact of this vulnerability is significant due to its unauthenticated nature and the ability to write arbitrary files. An attacker could leverage this to gain persistent access to the server by creating malicious configuration files, injecting backdoors, or even executing arbitrary code if the server environment allows it. The ability to list directory contents further exacerbates the risk, allowing attackers to identify sensitive files and potentially escalate their access. Successful exploitation could lead to complete server compromise and data exfiltration.

Organizations utilizing Saltcorn for internal application development or data management are at risk. Shared hosting environments where multiple Saltcorn instances reside on the same server are particularly vulnerable, as a compromise of one instance could potentially impact others. Legacy Saltcorn deployments using older versions are also at increased risk.

• nodejs: Monitor Saltcorn logs for unusual file creation events, particularly in unexpected directories. Use lsof or fuser to identify processes accessing sensitive files.

lsof | grep /path/to/saltcorn/data

• generic web: Monitor access logs for requests to /sync/offlinechanges and /sync/uploadfinished originating from unexpected IP addresses.

grep '/sync/offline_changes|/sync/upload_finished' /var/log/apache2/access.log

1. 2026-04-10Disclosure

   disclosure

1. Reserviert2026-04-09
2. Veröffentlicht2026-04-10
3. Geändert2026-04-15
4. EPSS aktualisiert2026-04-18

The primary mitigation is to upgrade Saltcorn to version 1.4.5, 1.5.5, or 1.6.0-beta.4. If immediate upgrading is not possible, consider implementing temporary workarounds such as restricting file system access permissions for the Saltcorn user account. Implement a Web Application Firewall (WAF) with rules to block requests containing path traversal attempts (e.g., ../ sequences). Monitor Saltcorn logs for suspicious file creation or access patterns. After upgrading, confirm the fix by attempting a path traversal attack via the /sync/offlinechanges and /sync/uploadfinished endpoints and verifying that access is denied.