How severe is GHSA-rj4j-2jph-gg43?

No CVSS score has been assigned to GHSA-rj4j-2jph-gg43 yet. Review the advisory details and affected package list to assess your exposure.

Which packages are affected by GHSA-rj4j-2jph-gg43?

GHSA-rj4j-2jph-gg43 affects the following packages: github.com/lf-edge/ekuiper/v2 (Go). Ecosystems affected: Go.

How do I fix GHSA-rj4j-2jph-gg43?

Update github.com/lf-edge/ekuiper/v2 to 2.3.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-rj4j-2jph-gg43 is resolved across your whole dependency graph.

How do I detect GHSA-rj4j-2jph-gg43 in my Go dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/lf-edge/ekuiper/v2, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

How do I mitigate GHSA-rj4j-2jph-gg43 if there is no patch (or I can't update yet)?

Resolve every user-supplied path to its canonical form and reject anything that escapes the intended directory, and run the component under an account that has no read or write access outside the directory it legitimately serves.

Is GHSA-rj4j-2jph-gg43 actively exploited in the wild?

No public exploit code has been indexed for GHSA-rj4j-2jph-gg43 yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

When was GHSA-rj4j-2jph-gg43 published, and has it been updated?

GHSA-rj4j-2jph-gg43 was published on November 24, 2025 and was last updated on November 27, 2025. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

🐹 Go

Not in CISA KEV

LF Edge eKuiper is vulnerable to Arbitrary File Read/Write via unsanitized names and zip extractionGHSA-rj4j-2jph-gg43

Fix: lf-edge/ekuiper#3911

GHSA-rj4j-2jph-gg43 is a security vulnerability in github.com/lf-edge/ekuiper/v2. A fix is available for github.com/lf-edge/ekuiper/v2 — see the affected versions and patch details below.

Also known asGO-2025-4158

Published

Nov 24, 2025

Updated

Nov 27, 2025

Affected

1 pkg

Patched

1 / 1

Exploits

None indexed

Exploitation data as of Nov 27, 2025 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected

🐹github.com/lf-edge/ekuiper/v2

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.

Description

Summary

Multiple path traversal and unsafe path handling vulnerabilities were discovered in eKuiper prior to the fixes implemented in PR lf-edge/ekuiper#3911. The issues allow attacker-controlled input (rule names, schema versions, plugin names, uploaded file names, and ZIP entries) to influence file system paths used by the application. In vulnerable deployments, this can permit files to be created, overwritten, or extracted outside the intended directories, potentially enabling disclosure of sensitive files, tampering with configuration or plugin binaries, denial of service, or other host compromise scenarios.

Several components used unvalidated user input when constructing filesystem paths or when extracting archives. In each case, input was accepted and used directly in path operations (join, create, delete, extract) without sufficient sanitization or canonicalization, allowing the input to include path separators, .. segments, or absolute paths.

Impact

Arbitrary file overwrite / deletion: attackers could overwrite or delete files outside the intended directory, which can corrupt application data, remove logs, or disable services.

Resources

Affected Packages

1 total 1 fixed

Ecosystem	Package	Vulnerable range	Fix
🐹Go	`github.com/lf-edge/ekuiper/v2`	all versions	2.3.0`go get github.com/lf-edge/ekuiper/v2@v2.3.0`

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/lf-edge/ekuiper/v2, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update github.com/lf-edge/ekuiper/v2 to 2.3.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-rj4j-2jph-gg43 is resolved across your whole dependency graph.
Workarounds
Resolve every user-supplied path to its canonical form and reject anything that escapes the intended directory, and run the component under an account that has no read or write access outside the directory it legitimately serves.

Frequently Asked Questions

### Summary Multiple path traversal and unsafe path handling vulnerabilities were discovered in eKuiper prior to the fixes implemented in PR [lf-edge/ekuiper#3911](https://github.com/lf-edge/ekuiper/pull/3911). The issues allow attacker-controlled input (rule names, schema versions, plugin names, uploaded file names, and ZIP entries) to influence file system paths used by the application. In vulnerable deployments, this can permit files to be created, overwritten, or extracted outside the intended directories, potentially enabling disclosure of sensitive files, tampering with configuration or

O3 Security · Impact-Aware SCA

Is GHSA-rj4j-2jph-gg43 in your dependencies?

Find it across Go, including transitive dependencies.

Scan my dependencies How O3 SCA works