Owncast · Owncast · CVE-2024-31450
**Name of the Vulnerable Software and Affected Versions**
Owncast versions prior to 0.1.3
**Description**
Owncast is an open source, self-hosted, decentralized, single user live video streaming and chat server. The Owncast application exposes an administrator API at the URL "/api/admin". The "emoji/delete" endpoint of said API allows administrators to delete custom emojis, which are saved on disk. The `name` parameter is taken from the JSON request and directly appended to the filepath that points to the emoji to delete. By using path traversal sequences (../), attackers with administrative privileges can exploit this endpoint to delete arbitrary files on the system, outside of the emoji directory.
**Recommendations**
For versions prior to 0.1.3, update to version 0.1.3 to resolve the issue. As a temporary workaround, consider restricting access to the "/api/admin" endpoint, specifically the "emoji/delete" endpoint, to minimize the risk of exploitation. Avoid using the `name` parameter in the affected API endpoint until the issue is resolved.