GHSA-9cp7-j3f8-p5jx

Source

https://github.com/advisories/GHSA-9cp7-j3f8-p5jx

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-9cp7-j3f8-p5jx/GHSA-9cp7-j3f8-p5jx.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-9cp7-j3f8-p5jx

Aliases

GO-2026-5285

Published

2026-04-10T22:11:04Z

Modified

2026-06-25T19:56:39Z

Severity

10.0 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H CVSS Calculator

Summary

Daptin has Unauthenticated Path Traversal and Zip Slip

Details

Impact

The cloudstore.file.upload action in server/actions/action_cloudstore_file_upload.go writes user-supplied filenames directly to disk without proper validation.

This allows unauthenticated attackers to perform path traversal and zip slip attacks, leading to arbitrary file write and potential remote code execution.

CVSS Score: 10.0 Critical CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H CWE: CWE-22 (Path Traversal)

Patches

Upgrade to a patched version once released. The vulnerability affects all versions <= v0.11.3 (latest).

Workarounds

Restrict access to the cloudstore.file.upload action through authentication and authorization controls until a patch is available.

Database specific

{
    "cwe_ids":  [
        "CWE-22"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-04-10T22:11:04Z",
    "nvd_published_at":  null,
    "severity":  "CRITICAL"
}

References

Affected packages

Go / github.com/daptin/daptin

Package

Name: github.com/daptin/daptin; View open source insights on deps.dev
Purl: pkg:golang/github.com/daptin/daptin

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.12.0

Database specific

last_known_affected_version_range

"<= 0.11.3"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-9cp7-j3f8-p5jx/GHSA-9cp7-j3f8-p5jx.json"