GHSA-54xj-q58h-9x57
Arbitrary File Write in iobroker.admin
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | iobroker.admin | < 3.6.12 | 3.6.12 |
Details
As written in the advisory (Markdown source, shown as plain text).
Versions of `iobroker.admin` prior to 3.6.12 are vulnerable to Path Traversal. The package fails to restrict access to folders outside of the intended folder in the `/log/` route, which may allow attackers to include arbitrary files in the system. An attacker would need to be authenticated to perform the attack but the package has authentication disabled by default.
## Recommendation
Upgrade to version 3.6.12 or later.
References
External links from the advisory. They lead to third-party sites.