GitHub Advisoryadvisory · Go

GHSA-9cp7-j3f8-p5jx Daptin has Unauthenticated Path Traversal and Zip Slip

CRITICAL Published 2026-04-10 Modified 2026-04-10 Official page ↗
Ecosystem
Go
Packages
github.com/daptin/daptin
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H
Weaknesses
CWE-22
Reviewed
2026-04-10

Affected packages

• Go github.com/daptin/daptin: < 0.12.0 → fixed in 0.12.0

Description

Impact The `cloudstore.file.upload` action in `server/actions/action_cloudstore_file_upload.go` writes user-supplied filenames directly to disk without proper validation. This allows unauthenticated attackers to perform path traversal and zip slip attacks, leading to arbitrary file write and potential remote code execution. CVSS Score: 10.0 Critical CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H CWE: CWE-22 (Path Traversal) Patches Upgrade to a patched version once released. The vulnerability affects all versions <= v0.11.3 (latest). Workarounds Restrict access to the cloudstore.file.upload action through authentication and authorization controls until a patch is available.

Related

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References