Decap Server
Monthly
Path traversal in decap-server 3.10.0 and earlier lets unauthenticated remote attackers read, write, and delete files in sibling directories that merely share the leading string of the configured local_git repository path. The flaw sits in the Joi input validator that guards the CORS-enabled /api/v1 JSON API: path.join plus a raw startsWith(repoPath) prefix check cannot distinguish a genuine child path from a sibling such as 'decaporg__decap-cms-owned' next to 'decaporg__decap-cms', so crafted '../<sibling>/file' payloads reach the getMediaFile, persistMedia and deleteFile handlers and achieve high-confidentiality, high-integrity and high-availability impact on files outside the repository root. Exploitation is constrained by deployment exposure (the package is a local development proxy usually bound to localhost) and by the prefix-collision requirement, which rules out arbitrary filesystem traversal to any absolute path; a public PoC reference exists but it is not verified as working exploit code, there is no confirmed actively exploited (CISA KEV) status, and EPSS is low at 0.29% (22nd percentile) even though the vuln.today priority label is act_now. Vendor-released patch: 3.11.0.
Path traversal in decap-server 3.10.0 and earlier lets unauthenticated remote attackers read, write, and delete files in sibling directories that merely share the leading string of the configured local_git repository path. The flaw sits in the Joi input validator that guards the CORS-enabled /api/v1 JSON API: path.join plus a raw startsWith(repoPath) prefix check cannot distinguish a genuine child path from a sibling such as 'decaporg__decap-cms-owned' next to 'decaporg__decap-cms', so crafted '../<sibling>/file' payloads reach the getMediaFile, persistMedia and deleteFile handlers and achieve high-confidentiality, high-integrity and high-availability impact on files outside the repository root. Exploitation is constrained by deployment exposure (the package is a local development proxy usually bound to localhost) and by the prefix-collision requirement, which rules out arbitrary filesystem traversal to any absolute path; a public PoC reference exists but it is not verified as working exploit code, there is no confirmed actively exploited (CISA KEV) status, and EPSS is low at 0.29% (22nd percentile) even though the vuln.today priority label is act_now. Vendor-released patch: 3.11.0.