Open-source package vulnerability · Go

GHSA-9cp7-j3f8-p5jx: Daptin has Unauthenticated Path Traversal and Zip Slip

criticalCVSS 3.1 10.0

Impact The cloudstore.file.upload action in server/actions/actioncloudstorefileupload.go writes user-supplied filenames directly to disk without proper validation. This allows unauthenticated attackers to perform path traversal and zip slip attacks, leading to arbitrary file write and potential remote code execution.

Published Apr 10, 2026

Affected packages

github.com/daptin/daptin

Ecosystem: Go
Affected: <= 0.11.3
Fixed in: 0.12.0
Check: go list -m github.com/daptin/daptin

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Impact

The cloudstore.file.upload action in server/actions/action_cloudstore_file_upload.go writes user-supplied filenames directly to disk without proper validation.

This allows unauthenticated attackers to perform path traversal and zip slip attacks, leading to arbitrary file write and potential remote code execution.

CVSS Score: 10.0 Critical CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H CWE: CWE-22 (Path Traversal)

Patches

Upgrade to a patched version once released. The vulnerability affects all versions <= v0.11.3 (latest).

Workarounds

Restrict access to the cloudstore.file.upload action through authentication and authorization controls until a patch is available.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology