Directory Traversal

Overview @saltcorn/server is a Server app for Saltcorn, open-source no-code platform Affected versions of this package are vulnerable to Directory Traversal via the POST /sync/offlinechanges and GET /sync/uploadfinished endpoints, which improperly handle user-supplied input in path construction. ...

EUVD-2026-21517

Saltcorn has an Unauthenticated Path Traversal in sync endpoints, allowing arbitrary file write and directory read...