提交 #1003748: cemtan sar2html 4.0.0 Path Traversal

sar2html 4.0.0 is affected by an unauthenticated path traversal
vulnerability (CWE-22) in the file upload endpoint.

The POST / route (function uploadFiles()) accepts .tar and .tar.gz
files from any remote user without requiring authentication. After
saving the uploaded file, it calls updateDb(), which extracts the
archive using Python's tarfile.extractall() without validating or
filtering the paths of the archive members:

with tarfile.open(s2dir + '/' + s2filename) as tar:
tar.extractall(path=s2tmp)

An attacker can craft a malicious tar archive containing members
with path traversal sequences (e.g. ../../etc/cron.d/backdoor,
../../root/.ssh/authorized_keys) to write arbitrary files outside
the intended extraction directory, anywhere the process has write
access.

The only input validation present is secure_filename() applied to
the outer archive filename — this does not affect the paths of
members inside the archive.

In typical deployments (Docker image running as root, as documented
in the official README), this vulnerability allows an unauthenticated
remote attacker to achieve Remote Code Execution by writing to
locations such as /etc/cron.d/ or by overwriting application files.

Affected component: sar2html.py, functions uploadFiles() and updateDb()
Attack vector: Network
Privileges required: None
User interaction: None
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

• 来源: ⚠️ https://github.com/cemtan/sar2html/issues/18
• 用户: spoo1k (UID 101695)
• 提交: 2026-09-28 10時45分 (17 日前)
• 管理: 2026-10-14 15時11分 (16 days later)
• 状态: 已接受
• VulDB条目: 419826 [cemtan sar2html 4.0.0 File Upload sar2html.py updateDb 目录遍历]
• 积分: 20