| 제목 | ErlichLiu claude-agent-sdk-master Commit b185aa7ff0d864581257008077b4010fca1747bf Path Traversal |
|---|
| 설명 | A path traversal file read vulnerability (CWE-22) has been identified in the 04-agent-teams component of claude-agent-sdk-master, specifically within app/api/agent-output/route.ts. The /api/agent-output endpoint accepts a user-supplied outputFile value from the request body and passes it directly to fs.readFile after path normalization, without verifying that the path resides within a trusted agent output directory or application workspace. An attacker with network access to the exposed Next.js API can read arbitrary local files readable by the server process, potentially disclosing sensitive configuration files, credentials, or source code. Commit b185aa7ff0d864581257008077b4010fca1747bf is confirmed affected, and no fixed version is available at the time of reporting.
|
|---|
| 원천 | ⚠️ https://github.com/ErlichLiu/claude-agent-sdk-master/issues/5 |
|---|
| 사용자 | BruceJin (UID 96538) |
|---|
| 제출 | 2026. 04. 11. AM 10:36 (6 개월 ago) |
|---|
| 모더레이션 | 2026. 04. 27. PM 07:05 (16 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 359844 [ErlichLiu claude-agent-sdk-master 까지 b185aa7ff0d864581257008077b4010fca1747bf route.ts outputFile 디렉토리 순회] |
|---|
| 포인트들 | 20 |
|---|