Listen to this Post
CVE-2026-69086 exposes a path‑traversal vulnerability in four attribute‑view read endpoints of the publish service. The core issue lies in how the service constructs filesystem paths from a caller‑controlled `id` or `avID` parameter. Normally, these identifiers should be confined to the attribute‑view storage directory (DataDir/storage/av/). However, the code uses `filepath.Join(DataDir, “storage”, “av”, avID+”.json”)` without any verification that the resulting path stays within that base directory. The `filepath.Join` function cleans the path but does not reject `../` sequences, so an attacker can inject directory traversal segments to escape the intended folder.
The flaw is exacerbated by a misplaced validation check. In the `model.RenderAttributeView` function, the only identifier guard (ast.IsNodeIDPattern(avID)) resides inside the `if !filelock.IsExist(existPath)` branch, which handles the case where the file does not already exist. When an attacker supplies an `avID` that resolves to an existing file (e.g., a `.json` file elsewhere in the workspace), the `!filelock.IsExist(…)` condition evaluates to false, the entire creation block is skipped, and the guard is never executed. Control passes directly to av.ParseAttributeView(avID), which rebuilds the path and calls filelock.ReadFile—the sink—with no additional boundary restrictions.
The same unsafe path construction appears in three other endpoints: getAttributeViewKeysByID, getAttributeViewKeys, and getCurrentAttrViewImages. These endpoints do not even include the creation branch, so they never reach any identifier validation at all. All four endpoints are gated only by CheckAuth, not CheckAdminRole. The publish service’s `RoleReader` token satisfies this check, and if `Publish.Auth.Enable` is set to false, the proxy falls back to an anonymous account, making the entire attack surface accessible without credentials.
Because the loaded file is unmarshalled into an attribute‑view structure, the reliable primitives are: (1) disclosure of attribute‑view (database) content from other scopes or notebooks that the reader is not authorized to access, and (2) a .json‑path existence oracle for arbitrary workspace locations. Files that do not conform to the AV schema are read but yield little meaningful data, and the `.json` suffix is forcibly appended, so this is not a general arbitrary‑file read. No CSRF token, write permission, or administrative role is required.
The root cause is placing identifier validation on a single code branch rather than confining the load operation to the AV base directory. The suggested fix is to validate `avID` with `ast.IsNodeIDPattern` before any path construction on all branches—or, preferably, to implement sink‑side confinement: compute the joined path and reject it unless `filepath.Rel(avBaseDir, cleaned)` stays within `avBaseDir` (no leading ..). Sink‑side confinement also covers the three `getAttributeView` endpoints that never reach the create‑branch guard.
DailyCVE Form:
Platform: Publish Service
Version: All versions
Vulnerability: Path Traversal
Severity: High
Date: 2026-XX-XX
Prediction: Expected patch TBD
What Undercode Say:
Analytics show that the most dangerous aspect is the combination of misplaced validation and default anonymous access when auth is disabled. Below are practical commands to test and understand the vulnerability.
Check if the service is reachable (default port 6808)
curl -s -o /dev/null -w "%{http_code}" http://target:6808/api/av/renderAttributeView
Example traversal payload (reads /etc/passwd? - but note .json appended, so target a .json file)
Suppose there is a sensitive .json file at /app/config/secrets.json
Construct avID = "../../../app/config/secrets" (without .json)
curl -X POST http://target:6808/api/av/renderAttributeView \
-H "Content-Type: application/json" \
-d '{"id":"../../../app/config/secrets"}'
If the file exists, it will be parsed and returned as an attribute-view structure.
For existence oracle, check response status (200 vs 404).
When Publish.Auth.Enable is false, no token is needed:
curl -X POST http://target:6808/api/av/getAttributeViewKeys \
-H "Content-Type: application/json" \
-d '{"id":"../../../data/sensitive"}'
Exploit: (Educational Purposes!)
- Identify a reachable publish instance (port 6808) and determine if authentication is required. If `Publish.Auth.Enable` is
false, proceed anonymously; otherwise, obtain a `RoleReader` token (e.g., from a compromised or low‑privilege account). - Choose one of the four vulnerable endpoints. For example, `POST /api/av/renderAttributeView` with parameter
id. - Craft the `id` value to include `../` segments that point to an existing `.json` file outside
DataDir/storage/av/. For instance, if the workspace root containsconfig/settings.json, use `id: “../../../config/settings”` (the service appends `.json` automatically). - Send the request. If the file exists, the server will attempt to unmarshal its contents into an attribute‑view schema. The response will contain the parsed data (or an error that reveals existence). If the file does not exist, the `!filelock.IsExist` branch triggers creation and the guard may block invalid IDs—so the attacker can distinguish existence by HTTP status or response body.
- Iterate over common `.json` paths to enumerate files and read sensitive configuration or database dumps from other notebooks.
Protection: from this CVE
- Immediate: Move the `ast.IsNodeIDPattern(avID)` validation before any call to `GetAttributeViewDataPath` or
FindAttributeViewPath, ensuring it executes unconditionally for all requests. - Robust: Implement sink‑side confinement inside `attributeViewDataPathByBox` /
GetAttributeViewDataPath. After computingfilepath.Join(DataDir, "storage", "av", avID+".json"), use `filepath.Rel(avBaseDir, cleanedPath)` and verify that the result does not start with... If it does, return an error immediately. - Defense‑in‑depth: Set `Publish.Auth.Enable = true` by default and enforce strong authentication for all `CheckAuth` endpoints.
- Monitoring: Log all requests to these endpoints with the
id/avIDvalues and alert on any that contain `../` or unusual patterns.
Impact:
Successful exploitation allows an authenticated (or anonymous, if auth is disabled) attacker to read `.json` files from arbitrary locations within the workspace, bypassing directory isolation. This leads to unauthorized disclosure of attribute‑view data from other scopes or notebooks, as well as a reliable oracle to test for the existence of any `.json` file. While the attack is limited to `.json` suffix and schema‑based unmarshalling, it can expose sensitive configuration, secrets, or user data stored in JSON format. The vulnerability requires no admin privileges, CSRF token, or write access, making it highly accessible and dangerous in multi‑tenant or shared environments.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
