https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 03:31:32 +0000 https://db.gcve.eu/vuln/ghsa-c23q-fw86-9h5x <p><strong>Affected:</strong> Go: github.com/lf-edge/ekuiper/v2</p> <p>### Summary A path traversal vulnerability in eKuiper&#39;s administrative management endpoints allows privileged users or attackers with access to management APIs to delete arbitrary files or directories on the host system.</p> <p>### Details In `internal/plugin/native/manager.go`, the plugin installation endpoint (`POST /plugins/*`) constructs a temporary directory path by directly joining user-supplied resource names (`name`) without sufficient sanitization. Supplying path traversal sequences (such as `../../...`) causes the deferred cleanup operation (`os.RemoveAll`) to target arbitrary directories outside the intended plugin directory.</p> <p>A related issue in configuration and rule lifecycle management where unvalidated rule identifiers could influence file deletion paths was also addressed by introducing unified identifier and file name validation.</p> <p>### PoC 1. Target file deletion via plugin installation endpoint: ```http POST /plugins/sources HTTP/1.1 Host: 127.0.0.1:9081 Content-Type: application/json</p> <p>{ &#34;name&#34;: &#34;../../../../../tmp/target.txt&#34;, &#34;file&#34;: &#34;http://example.com/plugin.zip&#34;, &#34;shellParas&#34;: [], &#34;functions&#34;: [] } ``` 2. When the request finishes, `/tmp/target.txt` is removed by `os.RemoveAll`.</p> <p>### Impact An attacker with access to eKuiper management APIs can cause arbitrary file or directory deletion, potentially leading to denial of service or disruption of the host environment. This vulnerability provides a delete-only capability and does not permit arbitrary fil…</p> <p><strong>Affected:</strong> Go: github.com/lf-edge/ekuiper/v2</p> <p>### Summary A path traversal vulnerability in eKuiper&#39;s administrative management endpoints allows privileged users or attackers with access to management APIs to delete arbitrary files or directories on the host system.</p> <p>### Details In `internal/plugin/native/manager.go`, the plugin installation endpoint (`POST /plugins/*`) constructs a temporary directory path by directly joining user-supplied resource names (`name`) without sufficient sanitization. Supplying path traversal sequences (such as `../../...`) causes the deferred cleanup operation (`os.RemoveAll`) to target arbitrary directories outside the intended plugin directory.</p> <p>A related issue in configuration and rule lifecycle management where unvalidated rule identifiers could influence file deletion paths was also addressed by introducing unified identifier and file name validation.</p> <p>### PoC 1. Target file deletion via plugin installation endpoint: ```http POST /plugins/sources HTTP/1.1 Host: 127.0.0.1:9081 Content-Type: application/json</p> <p>{ &#34;name&#34;: &#34;../../../../../tmp/target.txt&#34;, &#34;file&#34;: &#34;http://example.com/plugin.zip&#34;, &#34;shellParas&#34;: [], &#34;functions&#34;: [] } ``` 2. When the request finishes, `/tmp/target.txt` is removed by `os.RemoveAll`.</p> <p>### Impact An attacker with access to eKuiper management APIs can cause arbitrary file or directory deletion, potentially leading to denial of service or disruption of the host environment. This vulnerability provides a delete-only capability and does not permit arbitrary fil…</p> https://db.gcve.eu/vuln/ghsa-c23q-fw86-9h5x