@saltcorn/server arbitrary file and directory listing when accessing build mobile app results
Summary
A user with admin permission can read arbitrary file and directory names on the filesystem by calling the admin/build-mobile-app/result?build_dir_name= endpoint. The build_dir_name parameter is not properly validated and it's then used to construct the buildDir that is read. The file/directory names under the buildDir will be returned.
Details
- file: https://github.com/saltcorn/saltcorn/blob/v1.0.0-beta.13/packages/server/routes/admin.js#L2884-L2893
router.get(
"/build-mobile-app/result",
isAdmin,
error_catcher(async (req, res) => {
const { build_dir_name } = req.query; // [1] source
const rootFolder = await File.rootFolder();
const buildDir = path.join(
rootFolder.location,
"mobile_app",
build_dir_name // [2]
);
const files = await Promise.all(
fs
.readdirSync(buildDir) // [3] sink
.map(async (outFile) => await File.from_file_on_disk(outFile, buildDir))
);
[...]
})
);PoC
- log into the application as an admin user
- visit the following url:
http://localhost:3000/admin/build-mobile-app/result?build_dir_name=/../../../../../../../../
NOTE: it's possible to only see file and directory names but not to download their content.
Impact
Information disclosure
Recommended Mitigation
Resolve the buildDir and check if it starts with ${rootFolder.location}/mobile_app.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | @saltcorn/server | < 1.0.0-beta.14 | 1.0.0-beta.14 |
References
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N- Weakness (CWE)
CWE-548- Platform
- npm
- Package
@saltcorn/server- Disclosed
- 03.10.2024
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-cfqx-f43m-vfh7 - CC BY 4.0
Vulnerability history: @saltcorn/server
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 9
- First → latest
- 10.2024 04.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 2
- High 3
- Medium 4
Disclosures per year
- 2024: 5
- 2025: 0
- 2026: 4
-
@saltcorn/server arbitrary file and directory listing when accessing build mobile app results this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.