Saltcorn
Monthly
Unauthenticated path traversal in Saltcorn no-code application builder enables remote attackers to write arbitrary JSON files and create directories anywhere on the server filesystem via /sync/offline_changes endpoint, and read JSON files plus list directory contents via /sync/upload_finished endpoint. Affects Saltcorn versions prior to 1.4.5, 1.5.5, and 1.6.0-beta.4. No public exploit identified at time of analysis. Exploitation requires no authentication (CVSS PR:N), permitting arbitrary file write with high integrity impact and limited confidentiality exposure.
Unauthenticated path traversal in Saltcorn no-code application builder enables remote attackers to write arbitrary JSON files and create directories anywhere on the server filesystem via /sync/offline_changes endpoint, and read JSON files plus list directory contents via /sync/upload_finished endpoint. Affects Saltcorn versions prior to 1.4.5, 1.5.5, and 1.6.0-beta.4. No public exploit identified at time of analysis. Exploitation requires no authentication (CVSS PR:N), permitting arbitrary file write with high integrity impact and limited confidentiality exposure.