PT-2026-32005 · Saltcorn · Saltcorn

Published 2026-04-10 · Updated 2026-04-10 · CVE-2026-40163

NVD

CVSS v3.1

8.2

High

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

Saltcorn is an extensible, open source, no-code database application builder. Prior to 1.4.5, 1.5.5, and 1.6.0-beta.4, the POST /sync/offline changes endpoint allows an unauthenticated attacker to create arbitrary directories and write a changes.json file with attacker-controlled JSON content anywhere on the server filesystem. The GET /sync/upload finished endpoint allows an unauthenticated attacker to list arbitrary directory contents and read specific JSON files. This vulnerability is fixed in 1.4.5, 1.5.5, and 1.6.0-beta.4.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-40163

Affected Products

Saltcorn

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-40163 · Security Note
• https://github.com/saltcorn/saltcorn/security/advisories/GHSA-32pv-mpqg-h292 · Note