GHSA-9cp7-j3f8-p5jx
Daptin has Unauthenticated Path Traversal and Zip Slip
Impact
The cloudstore.file.upload action in server/actions/action_cloudstore_file_upload.go writes user-supplied filenames directly to disk without proper validation.
This allows unauthenticated attackers to perform path traversal and zip slip attacks, leading to arbitrary file write and potential remote code execution.
CVSS Score: 10.0 Critical CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H CWE: CWE-22 (Path Traversal)
Patches
Upgrade to a patched version once released. The vulnerability affects all versions <= v0.11.3 (latest).
Workarounds
Restrict access to the cloudstore.file.upload action through authentication and authorization controls until a patch is available.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- High
What each source reports
GitHub Advisories Score used
Daptin has Unauthenticated Path Traversal and Zip Slip
Impact
The cloudstore.file.upload action in server/actions/action_cloudstore_file_upload.go writes user-supplied filenames directly to disk without proper validation.
This allows unauthenticated attackers to perform path traversal and zip slip attacks, leading to arbitrary file write and potential remote code execution.
CVSS Score: 10.0 Critical CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H CWE: CWE-22 (Path Traversal)
Patches
Upgrade to a patched version once released. The vulnerability affects all versions <= v0.11.3 (latest).
Workarounds
Restrict access to the cloudstore.file.upload action through authentication and authorization controls until a patch is available.
- Record
GHSA-9cp7-j3f8-p5jx- CVSS 3.1
- 10.0 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H - Weakness
- CWE-22
- Updated
- 2026-11-02
OSV
Daptin has Unauthenticated Path Traversal and Zip Slip
Impact
The cloudstore.file.upload action in server/actions/action_cloudstore_file_upload.go writes user-supplied filenames directly to disk without proper validation.
This allows unauthenticated attackers to perform path traversal and zip slip attacks, leading to arbitrary file write and potential remote code execution.
CVSS Score: 10.0 Critical CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H CWE: CWE-22 (Path Traversal)
Patches
Upgrade to a patched version once released. The vulnerability affects all versions <= v0.11.3 (latest).
Workarounds
Restrict access to the cloudstore.file.upload action through authentication and authorization controls until a patch is available.
- Record
GHSA-9cp7-j3f8-p5jx- CVSS 3.1
- 10.0 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVGO-2026-5285No score
Daptin has Unauthenticated Path Traversal and Zip Slip in github.com/daptin/daptin
Daptin has Unauthenticated Path Traversal and Zip Slip in github.com/daptin/daptin
- Record
GO-2026-5285- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/daptin/daptinGo | through 0.11.3 | 0.12.0 |
github.com/daptin/daptinGo | before 0.12.0 | 0.12.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-9cp7-j3f8-p5jx is a critical vulnerability (CVSS 10.0) in github.com/daptin/daptin, published April 10, 2026. No source lists public exploit code. Fixed in github.com/daptin/daptin 0.12.0.