EUVD-2026-54274
GHSA-539j-9cqc-ppx4
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local-only attack vector with low privileges to invoke the file API; symmetric limited C/I/A impact confined to the server process scope with no scope change.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was detected in Lspace-io lspace-server up to 79f02fe5aa8970b210a6a05cf097155f8d9ffd71. This issue affects the function fileExists/readFile/writeFile/deleteFile of the file src/core/repository.ts of the component Repositories File API. Performing a manipulation of the argument filePath results in path traversal. The attack is only possible with local access. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Path traversal in lspace-server's Repositories File API permits low-privileged local attackers to escape the intended repository directory by manipulating the filePath argument passed to the fileExists, readFile, writeFile, and deleteFile functions in src/core/repository.ts. All commits up to 79f02fe5aa8970b210a6a05cf097155f8d9ffd71 are affected; the project uses rolling continuous delivery with no discrete versioned releases. A proof-of-concept exists (CVSS 4.0 E:P modifier), the vendor has not responded to responsible disclosure, and no patch has been released - though no active exploitation (CISA KEV) has been identified.
Technical ContextAI
lspace-server is an open-source server-side repository management tool hosted on GitHub (github.com/Lspace-io/lspace-server). The vulnerability is rooted in CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) within the Repositories File API layer implemented in src/core/repository.ts. Four functions - fileExists, readFile, writeFile, and deleteFile - accept a filePath argument that is consumed in file-system operations without sufficient path normalization or sanitization. This allows classic directory traversal sequences (e.g., ../../) to break out of the intended repository root. Because the project employs a continuous delivery model with rolling releases, no CPE version string is available; the affected revision ceiling is identified solely by commit hash 79f02fe5aa8970b210a6a05cf097155f8d9ffd71.
RemediationAI
No vendor-released patch has been identified at time of analysis; the maintainer was notified via GitHub issue (https://github.com/Lspace-io/lspace-server/issues/3) but has not responded. Until a fix is published, restrict local system access to only the minimum set of trusted users who require lspace-server interaction - removing local accounts that do not need it eliminates the PR:L prerequisite entirely. Apply OS-level filesystem sandboxing to confine the server process: running lspace-server inside a container (Docker/Podman) or under a chroot with AppArmor or SELinux policy limiting writable paths to the intended repository root will neutralize traversal even if the vulnerable code path is triggered; the trade-off is operational complexity in initial setup. Monitor application and audit logs for filePath values containing '../' sequences as an early-warning indicator. Avoid deploying lspace-server in multi-user or shared environments until a patched commit is available and verified.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today