Impact
This vulnerability allows arbitrary path traversal via the Projects API.
If the Projects feature is enabled, a user with projects.read permission is able to access any file via the Projects API.
Patches
The issue has been patched in Node-RED 1.2.8
Workarounds
The vulnerability applies only to the Projects feature which is not enabled by default in Node-RED.
The primary workaround is not give untrusted users read access to the Node-RED editor.
For more information
If you have any questions or comments about this advisory:
Acknowledgements
Thanks to the Tencent Woodpecker Security Team for disclosing this vulnerability.
Impact
This vulnerability allows arbitrary path traversal via the Projects API.
If the Projects feature is enabled, a user with
projects.readpermission is able to access any file via the Projects API.Patches
The issue has been patched in Node-RED 1.2.8
Workarounds
The vulnerability applies only to the Projects feature which is not enabled by default in Node-RED.
The primary workaround is not give untrusted users read access to the Node-RED editor.
For more information
If you have any questions or comments about this advisory:
Acknowledgements
Thanks to the Tencent Woodpecker Security Team for disclosing this vulnerability.