PT-2026-33892 · Go · Github.Com/Daptin/Daptin

Publicado 2026-04-10 · Atualizado 2026-04-10

OSV

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H

Impact

The cloudstore.file.upload action in server/actions/action cloudstore file upload.go writes user-supplied filenames directly to disk without proper validation.

This allows unauthenticated attackers to perform path traversal and zip slip attacks, leading to arbitrary file write and potential remote code execution.

CVSS Score: 10.0 Critical CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H CWE: CWE-22 (Path Traversal)

Patches

Upgrade to a patched version once released. The vulnerability affects all versions <= v0.11.3 (latest).

Workarounds

Restrict access to the cloudstore.file.upload action through authentication and authorization controls until a patch is available.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

GHSA-9CP7-J3F8-P5JX

Produtos afetados

Github.Com/Daptin/Daptin

Referências · 4

• https://github.com/daptin/daptin · Nota
• https://github.com/daptin/daptin/commit/8d626bbb14f82160a08cbca53e0749f475f5742c · Nota
• https://github.com/daptin/daptin/security/advisories/GHSA-9cp7-j3f8-p5jx · Nota
• https://osv.dev/vulnerability/GHSA-9cp7-j3f8-p5jx · Aviso do Fabricante