Отправить #860587: facil.io <= 0.7.58 Improper Limitation of a Pathname to a Restricted Directory

A remote client can send a request targeting "../" paths to the facil.io static file handler when the `public_folder` configuration option is enabled, resulting in a path traversal condition that allows access to files outside the intended document root. Although the server is expected to restrict access to the configured static directory, the request is still processed and the resolved file path escapes the `public_folder` boundary.

The root cause is a validation weakness in the path handling logic within `http_sendfile2` in `lib/facil/http/http.c`. The function constructs the final filesystem path by concatenating the configured `public_folder` with the incoming request path and performs a traversal check using `http_test_encoded_path()`. However, this check does not correctly handle paths that begin directly with "../", allowing them to bypass validation logic. In addition, the HTTP/1 parser accepts request targets that do not strictly begin with "/", which allows malformed request paths such as "../secret/secret.txt" to be processed.

When a request of this form is received, the resulting resolved path becomes "/var/www/public/../secret/secret.txt", which escapes the intended static file root directory. As a result, the server may return files outside the configured `public_folder` depending on filesystem permissions.

This results in a path traversal condition where an unauthenticated remote attacker can access arbitrary files outside the intended static directory. The vulnerability is remotely exploitable and requires no authentication, only network access to an exposed HTTP endpoint with `public_folder` enabled. The impact is primarily confidentiality-related and depends on the privilege level of the running process.

The issue has been reproduced on facil.io version 0.7.58 and earlier using default configuration with static file serving enabled. A proof-of-concept demonstrates that sending a request with a "../" prefixed path results in successful retrieval of files outside the intended directory.

Impact is limited by filesystem permissions but may allow disclosure of sensitive files, configuration data, or other restricted resources accessible to the server process.

Affected product: facil.io
Affected versions: 0.7.58 and earlier
No patch is currently available.

Severity: High (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness classification: CWE-22 Path Traversal

We attempted to report this issue via a GitHub Security Advisory submission to the upstream repository. However, there has been no response from the maintainers, and multiple email attempts to the project maintainers have also received no reply. As a result, we are now requesting CVE assignment through VulDB due to lack of upstream response and absence of any security coordination from the vendor.

• Источник: ⚠️ https://github.com/boazsegev/facil.io/issues/170
• Пользователь: Fantasy_2026 (UID 98691)
• Представление: 17.06.2026 05:10 (1 месяц назад)
• Модерация: 22.07.2026 20:20 (1 month later)
• Статус: принято
• Запись VulDB: 382396 [boazsegev facil.io до 0.7.58 Public Folder lib/facil/http/http.c http_sendfile2 обход каталога]
• Баллы: 20