Read the docs
TI-2026-30575 Aliases CVE-2026-42259GHSA-f3g8-9xv5-77gv

Saltcorn: Open Redirect in `POST /auth/login` due to incomplete `is_relative_url` validation (backslash bypass)

Priority MEDIUM 56CWE-601Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
Spoofing
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-601.

Summary

Saltcorn is an extensible, open source, no-code database application builder. Prior to versions 1.4.6, 1.5.6, and 1.6.0-beta.5, Saltcorn validates the post-login dest parameter with a string check that only blocks :/ and //. Because all WHATWG-compliant browsers normalise backslashes (\) to forward slashes (/) for special schemes, a payload such as /\evil.com/path slips through is_relative_url(), is emitted unchanged in the HTTP Location header, and causes the browser to navigate cross-origin to an attacker-controlled domain. The bug is reachable on a default install and only requires a victim who can be tricked into logging in via a crafted Saltcorn URL. This issue has been patched in versions 1.4.6, 1.5.6, and 1.6.0-beta.5.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00339 27th percentileScored 2026-11-07
Fix Fixed saltcorn (saltcorn): 1.4.6, 1.5.6, 1.6.0-beta.5@saltcorn/server (npm): 1.4.6, 1.5.6, 1.6.0-beta.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
saltcornsaltcornbefore 1.4.6; 1.5.0-beta.0 to before 1.5.6; 1.6.0-alpha.0 to before 1.6.0-beta.51.4.6, 1.5.6, 1.6.0-beta.5Patch availableCNA
—@saltcorn/server (npm)before 1.4.61.4.6Patch availableGHSA-f3g8-9xv5-77gv
—@saltcorn/server (npm)1.5.0-beta.0 to before 1.5.61.5.6Patch availableGHSA-f3g8-9xv5-77gv
—@saltcorn/server (npm)1.6.0-alpha.0 to before 1.6.0-beta.51.6.0-beta.5Patch availableGHSA-f3g8-9xv5-77gv
  • saltcorn Vendorsaltcorn Affected before 1.4.6; 1.5.0-beta.0 to before 1.5.6; 1.6.0-alpha.0 to before 1.6.0-beta.5 Fixed in 1.4.6, 1.5.6, 1.6.0-beta.5 Patch available CNA
  • @saltcorn/server (npm) Vendor— Affected before 1.4.6 Fixed in 1.4.6 Patch available GHSA-f3g8-9xv5-77gv
  • @saltcorn/server (npm) Vendor— Affected 1.5.0-beta.0 to before 1.5.6 Fixed in 1.5.6 Patch available GHSA-f3g8-9xv5-77gv
  • @saltcorn/server (npm) Vendor— Affected 1.6.0-alpha.0 to before 1.6.0-beta.5 Fixed in 1.6.0-beta.5 Patch available GHSA-f3g8-9xv5-77gv

Remediation

  • Fix · CNA saltcorn (saltcorn) Fixed in 1.4.6, 1.5.6, 1.6.0-beta.5
  • Fix · GHSA-f3g8-9xv5-77gv @saltcorn/server (npm) Fixed in 1.4.6 Advisory →
  • Fix · GHSA-f3g8-9xv5-77gv @saltcorn/server (npm) Fixed in 1.5.6 Advisory →
  • Fix · GHSA-f3g8-9xv5-77gv @saltcorn/server (npm) Fixed in 1.6.0-beta.5 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-42259
  2. 2026-10-03 Alias added: GHSA-f3g8-9xv5-77gv

References

Advisory 1

Other 2

  • TI-2026-30066 Saltcorn: SQL Injection via Unparameterized Sync Endpoints (maxLoadedId) CVSS 3.1CRITICAL 10.0
  • TI-2026-28978 Saltcorn has an Unauthenticated Path Traversal in sync endpoints allows arbitrary file write and directory read CVSS 3.1HIGH 8.2
  • TI-2024-32085 Logged-in users with any role can delete arbitrary files in @saltcorn/server CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences