| Título | blackms aistack 1.6.1 Path Traversal |
|---|
| Descrição | The blackms/aistack local web server serves frontend static files from the web/dist directory. The static file handler joins the incoming HTTP request URL with the frontend build directory and then reads the resulting path from disk. It does not appear to enforce that the resolved path remains inside the intended static asset directory.
In a local reproduction, a test file was created outside the repository directory. After starting the aistack web server, a normal request to /index.html returned the expected frontend asset. A traversal request using curl --path-as-is and a path such as /../../../outside-poc/outside-secret.txt returned the marker from the external file. This confirms that the HTTP request path can escape the web/dist static directory and cause the server to read files outside the intended static root.
This demonstrates a path traversal / arbitrary static file read issue. An attacker who can access the local web server may read files accessible to the aistack process, depending on deployment exposure and filesystem permissions. |
|---|
| Fonte | ⚠️ https://github.com/blackms/aistack/issues/57 |
|---|
| Utilizador | cccccccti (UID 96695) |
|---|
| Submissão | 12/07/2026 17h49 (há 2 meses) |
|---|
| Moderação | 27/08/2026 07h00 (2 months later) |
|---|
| Estado | Aceite |
|---|
| Entrada VulDB | 396057 [blackms aistack até 1.6.1 Static File src/web/server.ts req.url Travessia de Diretório] |
|---|
| Pontos | 20 |
|---|