GHSA-xvww-xhx6-22pf SillyTavern has a path traversal in `/api/chats/import` allows arbitrary file write outside intended chat directory

• npm sillytavern: < 1.17.0 → fixed in 1.17.0

Summary A path traversal vulnerability in `/api/chats/import` allows an authenticated attacker to write attacker-controlled files outside the intended chats directory by injecting traversal sequences into `character_name`. Details `character_name` is used unsafely as part of the destination filename and then passed into `path.join(...)` without sanitization. Evidence: • Import handler entrypoint: • Unsanitized `character_name` used in output filename: • Same write pattern in JSONL import branch: • Endpoint auth context (authenticated user access): Example payload: • `character_name=../../../../tmp/st_poc` This causes the final destination path to escape from `/chats//...` and write to an attacker-controlled location such as `/tmp/...` (or any writable path for the service account). PoC Prerequisites: • Valid authenticated session cookie (`cookie.txt`) • Valid CSRF token (`$TOKEN`) Prepare payload: ```bash printf '{"user_name":"u","chat_metadata":{}}\n{"name":"u","mes":"owned"}\n' >/tmp/poc.jsonl ``` Trigger arbitrary write: ```bash curl -b cookie.txt -H "x-csrf-token: $TOKEN" \ -F "avatar=@/tmp/poc.jsonl" \ -F "file_type=jsonl" \ -F "avatar_url=a.png" \ -F "character_name=../../../../tmp/st_poc" \ -F "user_name=u" \ http://TARGET:8000/api/chats/import ``` Observed result: • A file is created outside chats directory, for example: `/tmp/st_poc - imported.jsonl` Impact • Integrity: attacker can create files in unintended filesystem locations. • Availability: can be used for disk abuse and disruptive file placement. • Can become more severe when chained with other local processing behaviors. Resolution The issue was addressed in version 1.17.0