TI-2024-32085 Aliases CVE-2024-47818 GHSA-43f3-h63w-p6f6

Logged-in users with any role can delete arbitrary files in @saltcorn/server

MEDIUM 62CWE-22Published 2024-10-07 · Updated 2024-10-08

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-22 and the CVSS impact.

Summary

Saltcorn is an extensible, open source, no-code database application builder. A logged-in user with any role can delete arbitrary files on the filesystem by calling the `sync/clean_sync_dir` endpoint. The `dir_name` POST parameter is not validated/sanitized and is used to construct the `syncDir` that is deleted by calling `fs.rm`. This issue has been addressed in release version 1.0.0-beta16 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00783 56th percentileScored 2026-11-07

Fix Fixed saltcorn (saltcorn): 1.0.0-beta.16@saltcorn/server (npm): 1.0.0-beta.16

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
saltcorn	saltcorn	before 1.0.0-beta.16	1.0.0-beta.16	Patch available	CNA
—	@saltcorn/server (npm)	before 1.0.0-beta.16	1.0.0-beta.16	Patch available	GHSA-43f3-h63w-p6f6

saltcorn Vendorsaltcorn Affected before 1.0.0-beta.16 Fixed in 1.0.0-beta.16 Patch available CNA
@saltcorn/server (npm) Vendor— Affected before 1.0.0-beta.16 Fixed in 1.0.0-beta.16 Patch available GHSA-43f3-h63w-p6f6

CPE names CISA-ADP · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:saltcorn_collective_ltd:saltcorn::::::::	—	—	—

cpe:2.3:a:saltcorn_collective_ltd:saltcorn:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

Fix · CNA saltcorn (saltcorn) Fixed in 1.0.0-beta.16
Fix · GHSA-43f3-h63w-p6f6 @saltcorn/server (npm) Fixed in 1.0.0-beta.16 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2024-47818
2026-10-03 Alias added: GHSA-43f3-h63w-p6f6

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2024-47818

Other 4

TI-2026-30066 Saltcorn: SQL Injection via Unparameterized Sync Endpoints (maxLoadedId) CVSS 3.1CRITICAL 10.0
TI-2026-28978 Saltcorn has an Unauthenticated Path Traversal in sync endpoints allows arbitrary file write and directory read CVSS 3.1HIGH 8.2
TI-2026-30575 Saltcorn: Open Redirect in `POST /auth/login` due to incomplete `is_relative_url` validation (backslash bypass) CVSS 4.0MEDIUM 5.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences