Submit #994176: EventCatalog @eventcatalog/sdk 2.29.0 Path Traversal

A path traversal vulnerability affects the custom documentation helpers in the EventCatalog SDK.

Affected component: @eventcatalog/sdk
Affected source file: packages/sdk/src/custom-docs.ts
Affected version tested: 2.29.0

Technical details:
The getCustomDoc() function constructs a path with path.join(directory, filePath) and reads the resulting file without verifying that the resolved path remains inside the catalog root. The writeCustomDoc() function constructs a path with path.join(directory, options.path || '', withExtension) and then creates directories and writes the document. The rmCustomDoc() function constructs a path with join(directory, withExtension) and removes it recursively. None of these three operations performs a resolved-path boundary check. Absolute paths and parent-directory components such as .. can therefore escape the catalog directory.

Harmless reproduction:
1. Set directory to a temporary catalog directory.
2. Call writeCustomDoc with options.path set to ../outside-write and fileName set to marker.
3. Observe that marker.mdx is created outside the catalog directory.
4. Create a marker file outside the catalog directory and call getCustomDoc with ../outside-read/secret.mdx. The file is read successfully.
5. Call rmCustomDoc with ../outside-delete/delete-me.mdx. The file outside the catalog directory is removed.

The attached verification script uses only a temporary directory and harmless marker files. It does not contact a network service, execute commands, or access real user data.

Impact:
An attacker who can control these SDK path parameters may cause arbitrary file writes, reads, or recursive deletion outside the intended catalog root. The standalone SDK is a local library and this finding is not claimed to be unauthenticated remote code execution. The impact becomes application-level when a plugin, automation service, or web application passes untrusted input to these APIs.

Suggested remediation:
Resolve the catalog root and candidate path with path.resolve(), reject absolute paths and any candidate that is not equal to the root or located below root plus path.sep, and apply the check consistently to read, write, and delete operations. Also consider symlink-aware realpath checks and dedicated Windows and POSIX traversal tests.

The exact affected release range and patched release should be confirmed by the vendor.

• Source: ⚠️ https://github.com/event-catalog/eventcatalog/blob/main/packages/sdk/src/custom-docs.ts
• User: pure (UID 100805)
• Submission: 09/22/2026 15:04 (1 month ago)
• Moderation: 10/24/2026 15:57 (1 month later)
• Status: Accepted
• VulDB entry: 426122 [eventcatalog sdk up to 2.29.0 Custom Documentation Helpers custom-docs.ts getCustomDoc/writeCustomDoc/rmCustomDoc options.path path traversal]
• Points: 20