Aistack
Monthly
Path traversal in blackms aistack's Static File Handler (src/web/server.ts) exposes arbitrary server-side files to unauthenticated remote attackers via unsanitized req.url processing. All versions through 1.6.1 are confirmed affected per NVD CPE data, and a public proof-of-concept exploit exists in GitHub issue #57. The project received responsible disclosure but has not responded, meaning no patch is available at time of analysis.
Path traversal in blackms aistack's Static File Handler (src/web/server.ts) exposes arbitrary server-side files to unauthenticated remote attackers via unsanitized req.url processing. All versions through 1.6.1 are confirmed affected per NVD CPE data, and a public proof-of-concept exploit exists in GitHub issue #57. The project received responsible disclosure but has not responded, meaning no patch is available at time of analysis.