| 제목 | blackms aistack 1.6.1 Path Traversal |
|---|
| 설명 | The blackms/aistack local web server serves frontend static files from the web/dist directory. The static file handler joins the incoming HTTP request URL with the frontend build directory and then reads the resulting path from disk. It does not appear to enforce that the resolved path remains inside the intended static asset directory.
In a local reproduction, a test file was created outside the repository directory. After starting the aistack web server, a normal request to /index.html returned the expected frontend asset. A traversal request using curl --path-as-is and a path such as /../../../outside-poc/outside-secret.txt returned the marker from the external file. This confirms that the HTTP request path can escape the web/dist static directory and cause the server to read files outside the intended static root.
This demonstrates a path traversal / arbitrary static file read issue. An attacker who can access the local web server may read files accessible to the aistack process, depending on deployment exposure and filesystem permissions. |
|---|
| 원천 | ⚠️ https://github.com/blackms/aistack/issues/57 |
|---|
| 사용자 | cccccccti (UID 96695) |
|---|
| 제출 | 2026. 07. 12. PM 05:49 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 08. 27. AM 07:00 (2 months later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 396057 [blackms aistack 까지 1.6.1 Static File src/web/server.ts req.url 디렉토리 순회] |
|---|
| 포인트들 | 20 |
|---|