Saltcorn has an Unauthenticated Path Traversal in sync endpoints allows arbitrary file write and directory read
Priority HIGH 75CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
Saltcorn is an extensible, open source, no-code database application builder. Prior to 1.4.5, 1.5.5, and 1.6.0-beta.4, the POST /sync/offline_changes endpoint allows an unauthenticated attacker to create arbitrary directories and write a changes.json file with attacker-controlled JSON content anywhere on the server filesystem. The GET /sync/upload_finished endpoint allows an unauthenticated attacker to list arbitrary directory contents and read specific JSON files. This vulnerability is fixed in 1.4.5, 1.5.5, and 1.6.0-beta.4.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00339 27th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed saltcorn (saltcorn): 1.4.5, 1.5.5, 1.6.0-beta.4@saltcorn/server (npm): 1.4.5, 1.5.5, 1.6.0-beta.4
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| saltcorn | saltcorn | before 1.4.5; 1.5.0-beta.0 to before 1.5.5; 1.6.0-alpha.0 to before 1.6.0-beta.4 | 1.4.5, 1.5.5, 1.6.0-beta.4 | Patch available | CNA |
| — | @saltcorn/server (npm) | before 1.4.5 | 1.4.5 | Patch available | GHSA-32pv-mpqg-h292 |
| — | @saltcorn/server (npm) | 1.5.0-beta.0 to before 1.5.5 | 1.5.5 | Patch available | GHSA-32pv-mpqg-h292 |
| — | @saltcorn/server (npm) | 1.6.0-alpha.0 to before 1.6.0-beta.4 | 1.6.0-beta.4 | Patch available | GHSA-32pv-mpqg-h292 |
- saltcorn Vendorsaltcorn Affected before 1.4.5; 1.5.0-beta.0 to before 1.5.5; 1.6.0-alpha.0 to before 1.6.0-beta.4 Fixed in 1.4.5, 1.5.5, 1.6.0-beta.4 Patch available CNA
- @saltcorn/server (npm) Vendor— Affected before 1.4.5 Fixed in 1.4.5 Patch available GHSA-32pv-mpqg-h292
- @saltcorn/server (npm) Vendor— Affected 1.5.0-beta.0 to before 1.5.5 Fixed in 1.5.5 Patch available GHSA-32pv-mpqg-h292
- @saltcorn/server (npm) Vendor— Affected 1.6.0-alpha.0 to before 1.6.0-beta.4 Fixed in 1.6.0-beta.4 Patch available GHSA-32pv-mpqg-h292
CPE configurations NVD · 22
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:saltcorn:saltcorn:*:*:*:*:*:*:*:* | before 1.4.5; 1.5.0 to before 1.5.5 | Vulnerable | saltcorn |
| cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha0:*:*:*:*:*:* | 1.6.0 alpha0 | Vulnerable | saltcorn |
| cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha1:*:*:*:*:*:* | 1.6.0 alpha1 | Vulnerable | saltcorn |
| cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha10:*:*:*:*:*:* | 1.6.0 alpha10 | Vulnerable | saltcorn |
| cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha11:*:*:*:*:*:* | 1.6.0 alpha11 | Vulnerable | saltcorn |
| cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha12:*:*:*:*:*:* | 1.6.0 alpha12 | Vulnerable | saltcorn |
| cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha13:*:*:*:*:*:* | 1.6.0 alpha13 | Vulnerable | saltcorn |
| cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha14:*:*:*:*:*:* | 1.6.0 alpha14 | Vulnerable | saltcorn |
| cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha15:*:*:*:*:*:* | 1.6.0 alpha15 | Vulnerable | saltcorn |
| cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha16:*:*:*:*:*:* | 1.6.0 alpha16 | Vulnerable | saltcorn |
- cpe:2.3:a:saltcorn:saltcorn:*:*:*:*:*:*:*:* Versions before 1.4.5; 1.5.0 to before 1.5.5 Vulnerable ·saltcorn
- cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha0:*:*:*:*:*:* Versions 1.6.0 alpha0 Vulnerable ·saltcorn
- cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha1:*:*:*:*:*:* Versions 1.6.0 alpha1 Vulnerable ·saltcorn
- cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha10:*:*:*:*:*:* Versions 1.6.0 alpha10 Vulnerable ·saltcorn
- cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha11:*:*:*:*:*:* Versions 1.6.0 alpha11 Vulnerable ·saltcorn
- cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha12:*:*:*:*:*:* Versions 1.6.0 alpha12 Vulnerable ·saltcorn
- cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha13:*:*:*:*:*:* Versions 1.6.0 alpha13 Vulnerable ·saltcorn
- cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha14:*:*:*:*:*:* Versions 1.6.0 alpha14 Vulnerable ·saltcorn
- cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha15:*:*:*:*:*:* Versions 1.6.0 alpha15 Vulnerable ·saltcorn
- cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha16:*:*:*:*:*:* Versions 1.6.0 alpha16 Vulnerable ·saltcorn
Show 12 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha17:*:*:*:*:*:* | 1.6.0 alpha17 | Vulnerable | saltcorn |
| cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha2:*:*:*:*:*:* | 1.6.0 alpha2 | Vulnerable | saltcorn |
| cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha3:*:*:*:*:*:* | 1.6.0 alpha3 | Vulnerable | saltcorn |
| cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha4:*:*:*:*:*:* | 1.6.0 alpha4 | Vulnerable | saltcorn |
| cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha5:*:*:*:*:*:* | 1.6.0 alpha5 | Vulnerable | saltcorn |
| cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha6:*:*:*:*:*:* | 1.6.0 alpha6 | Vulnerable | saltcorn |
| cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha7:*:*:*:*:*:* | 1.6.0 alpha7 | Vulnerable | saltcorn |
| cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha8:*:*:*:*:*:* | 1.6.0 alpha8 | Vulnerable | saltcorn |
| cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha9:*:*:*:*:*:* | 1.6.0 alpha9 | Vulnerable | saltcorn |
| cpe:2.3:a:saltcorn:saltcorn:1.6.0:beta1:*:*:*:*:*:* | 1.6.0 beta1 | Vulnerable | saltcorn |
| cpe:2.3:a:saltcorn:saltcorn:1.6.0:beta2:*:*:*:*:*:* | 1.6.0 beta2 | Vulnerable | saltcorn |
| cpe:2.3:a:saltcorn:saltcorn:1.6.0:beta3:*:*:*:*:*:* | 1.6.0 beta3 | Vulnerable | saltcorn |
- cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha17:*:*:*:*:*:* Versions 1.6.0 alpha17 Vulnerable ·saltcorn
- cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha2:*:*:*:*:*:* Versions 1.6.0 alpha2 Vulnerable ·saltcorn
- cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha3:*:*:*:*:*:* Versions 1.6.0 alpha3 Vulnerable ·saltcorn
- cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha4:*:*:*:*:*:* Versions 1.6.0 alpha4 Vulnerable ·saltcorn
- cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha5:*:*:*:*:*:* Versions 1.6.0 alpha5 Vulnerable ·saltcorn
- cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha6:*:*:*:*:*:* Versions 1.6.0 alpha6 Vulnerable ·saltcorn
- cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha7:*:*:*:*:*:* Versions 1.6.0 alpha7 Vulnerable ·saltcorn
- cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha8:*:*:*:*:*:* Versions 1.6.0 alpha8 Vulnerable ·saltcorn
- cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha9:*:*:*:*:*:* Versions 1.6.0 alpha9 Vulnerable ·saltcorn
- cpe:2.3:a:saltcorn:saltcorn:1.6.0:beta1:*:*:*:*:*:* Versions 1.6.0 beta1 Vulnerable ·saltcorn
- cpe:2.3:a:saltcorn:saltcorn:1.6.0:beta2:*:*:*:*:*:* Versions 1.6.0 beta2 Vulnerable ·saltcorn
- cpe:2.3:a:saltcorn:saltcorn:1.6.0:beta3:*:*:*:*:*:* Versions 1.6.0 beta3 Vulnerable ·saltcorn
Remediation
- Fix · CNA saltcorn (saltcorn) Fixed in 1.4.5, 1.5.5, 1.6.0-beta.4
- Fix · GHSA-32pv-mpqg-h292 @saltcorn/server (npm) Fixed in 1.4.5 Advisory →
- Fix · GHSA-32pv-mpqg-h292 @saltcorn/server (npm) Fixed in 1.5.5 Advisory →
- Fix · GHSA-32pv-mpqg-h292 @saltcorn/server (npm) Fixed in 1.6.0-beta.4 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-40163
- 2026-10-03 Alias added: GHSA-32pv-mpqg-h292
References
More Saltcorn vulnerabilities
- TI-2026-30066 Saltcorn: SQL Injection via Unparameterized Sync Endpoints (maxLoadedId) CVSS 3.1CRITICAL 10.0
Sources
- CVE-2026-40163 · CVE Program
- CVE-2026-40163 · NVD
- FIRST EPSS
- GHSA-32pv-mpqg-h292 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences