| शीर्षक | cemtan sar2html 4.0.0 Path Traversal |
|---|
| विवरण | sar2html 4.0.0 is affected by an unauthenticated path traversal
vulnerability (CWE-22) in the file upload endpoint.
The POST / route (function uploadFiles()) accepts .tar and .tar.gz
files from any remote user without requiring authentication. After
saving the uploaded file, it calls updateDb(), which extracts the
archive using Python's tarfile.extractall() without validating or
filtering the paths of the archive members:
with tarfile.open(s2dir + '/' + s2filename) as tar:
tar.extractall(path=s2tmp)
An attacker can craft a malicious tar archive containing members
with path traversal sequences (e.g. ../../etc/cron.d/backdoor,
../../root/.ssh/authorized_keys) to write arbitrary files outside
the intended extraction directory, anywhere the process has write
access.
The only input validation present is secure_filename() applied to
the outer archive filename — this does not affect the paths of
members inside the archive.
In typical deployments (Docker image running as root, as documented
in the official README), this vulnerability allows an unauthenticated
remote attacker to achieve Remote Code Execution by writing to
locations such as /etc/cron.d/ or by overwriting application files.
Affected component: sar2html.py, functions uploadFiles() and updateDb()
Attack vector: Network
Privileges required: None
User interaction: None
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N |
|---|
| स्रोत | ⚠️ https://github.com/cemtan/sar2html/issues/18 |
|---|
| उपयोगकर्ता | spoo1k (UID 101695) |
|---|
| सबमिशन | 28/09/2026 10:45 AM (17 दिन पहले) |
|---|
| संयम | 14/10/2026 03:11 PM (16 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 419826 [cemtan sar2html 4.0.0 File Upload sar2html.py updateDb निर्देशिका ट्रैवर्सल] |
|---|
| अंक | 20 |
|---|