GHSA-cfqx-f43m-vfh7 is a medium-severity (CVSS 4.9) vulnerability in @saltcorn/server. A fix is available for @saltcorn/server — see the affected versions and patch details below.
@saltcorn/server arbitrary file and directory listing when accessing build mobile app results
Real-World Exposure
How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.
@saltcorn/servernpmDescription
Summary
A user with admin permission can read arbitrary file and directory names on the filesystem by calling the admin/build-mobile-app/result?build_dir_name= endpoint. The build_dir_name parameter is not properly validated and it's then used to construct the buildDir that is read. The file/directory names under the buildDir will be returned.
Details
- file: https://github.com/saltcorn/saltcorn/blob/v1.0.0-beta.13/packages/server/routes/admin.js#L2884-L2893
router.get(
"/build-mobile-app/result",
isAdmin,
error_catcher(async (req, res) => {
const { build_dir_name } = req.query; // [1] source
const rootFolder = await File.rootFolder();
const buildDir = path.join(
rootFolder.location,
"mobile_app",
build_dir_name // [2]
);
const files = await Promise.all(
fs
.readdirSync(buildDir) // [3] sink
.map(async (outFile) => await File.from_file_on_disk(outFile, buildDir))
);
[...]
})
);
PoC
- log into the application as an admin user
- visit the following url:
http://localhost:3000/admin/build-mobile-app/result?build_dir_name=/../../../../../../../../
NOTE: it's possible to only see file and directory names but not to download their content.
Impact
Information disclosure
Recommended Mitigation
Resolve the buildDir and check if it starts with ${rootFolder.location}/mobile_app.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | @saltcorn/server | all versions | 1.0.0-beta.14npm install @saltcorn/server@1.0.0-beta.14 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for @saltcorn/server, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update @saltcorn/server to 1.0.0-beta.14 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-cfqx-f43m-vfh7 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like GHSA-cfqx-f43m-vfh7 can be triaged on real exposure rather than presence alone.
Tailored to GHSA-cfqx-f43m-vfh7. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is GHSA-cfqx-f43m-vfh7 in your dependencies?
O3 Security finds GHSA-cfqx-f43m-vfh7 across npm dependencies, including transitive ones, and its impact-aware SCA ranks findings by whether your code actually calls the vulnerable path.