Directory Traversal

@saltcorn/server is vulnerable to Directory Traversal. The vulnerability is due to missing sanitization of the filename parameter used to identify the zip file when passed to the res.download API. This allows an attacker with admin permission to read and download arbitrary zip files when...

@saltcorn/server arbitrary file zip read and download when downloading auto backups

Summary A user with admin permission can read and download arbitrary zip files when downloading auto backups. The file name used to identify the zip file is not properly sanitized when passed to res.download API. Details - file:...

GHSA-277H-PX4M-62Q8 @saltcorn/server arbitrary file zip read and download when downloading auto backups

Summary A user with admin permission can read and download arbitrary zip files when downloading auto backups. The file name used to identify the zip file is not properly sanitized when passed to res.download API. Details - file:...