| タイトル | blackms aistack 1.6.1 Path Traversal |
|---|
| 説明 | The blackms/aistack local web server serves frontend static files from the web/dist directory. The static file handler joins the incoming HTTP request URL with the frontend build directory and then reads the resulting path from disk. It does not appear to enforce that the resolved path remains inside the intended static asset directory.
In a local reproduction, a test file was created outside the repository directory. After starting the aistack web server, a normal request to /index.html returned the expected frontend asset. A traversal request using curl --path-as-is and a path such as /../../../outside-poc/outside-secret.txt returned the marker from the external file. This confirms that the HTTP request path can escape the web/dist static directory and cause the server to read files outside the intended static root.
This demonstrates a path traversal / arbitrary static file read issue. An attacker who can access the local web server may read files accessible to the aistack process, depending on deployment exposure and filesystem permissions. |
|---|
| ソース | ⚠️ https://github.com/blackms/aistack/issues/57 |
|---|
| ユーザー | cccccccti (UID 96695) |
|---|
| 送信 | 2026年07月12日 17:49 (2 月 ago) |
|---|
| モデレーション | 2026年08月27日 07:00 (2 months later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 396057 [blackms aistack 迄 1.6.1 Static File src/web/server.ts req.url ディレクトリトラバーサル] |
|---|
| ポイント | 20 |
|---|