CVE-2022-46171 Tauri vulnerable to path traversal
Tauri framework allows attackers to read files in subdirectories of allowed paths due to incorrect wildcard handling in filesystem glob patterns.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-46171?
CVE-2022-46171 is a medium-severity path traversal vulnerability in tauri-apps tauri, published on 23 Dec 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Tauri is a framework for building binaries for all major desktop platforms. The filesystem glob pattern wildcards `*`, `?`, and `[...]` match file path literals and leading dots by default, which unintentionally exposes sub folder content of allowed paths. Scopes without the wildcards are not affected. As `**` allows for sub directories the behavior there is also as expected. The issue has been patched in the latest release and was backported into the currently supported 1.x branches. There are no known workarounds at the time of publication.
Weakness: CWE-22
Which versions are affected by CVE-2022-46171?
8 open source packages ship an affected version, including tauri. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
tauri crates.io | From 1.0.0 | 1.0.8 |
tauri crates.io | From 1.0.0 | 1.0.8 |
tauri crates.io | From 1.1.0 | 1.1.3 |
tauri crates.io | From 1.1.0 | 1.1.3 |
tauri crates.io | From 1.2.0 | 1.2.3 |
tauri crates.io | From 1.2.0 | 1.2.3 |
2 more packages
tauri crates.io | From 2.0.0-alpha.0 | 2.0.0-alpha.2 |
tauri crates.io | From 2.0.0-alpha.0 | 2.0.0-alpha.2 |
Products include Tauri Tauri.
How do I fix CVE-2022-46171?
Upgrade tauri to a fixed version for your release line: 1.0.8, 1.1.3, 1.2.3 or 2.0.0-alpha.2.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2022-46171 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-46171 exists.
Other vulnerabilities in tauri-apps tauri
- CVE-2023-46115 Updater Private Keys Possibly Leaked via Vite Environment Variables in tauri-cli
- CVE-2022-39215 The readDir Endpoint Scope can be Bypassed With Symbolic Links in Tauri
- CVE-2026-42184 Tauri: Origin Confusion Allows Remote Pages to Invoke Local-Only IPC Commands
- CVE-2023-34460 Tauri vulnerable to Regression on Filesystem Scope Checks for Dotfiles
- CVE-2023-31134 Tauri Open Redirect Vulnerability Possibly Exposes IPC to External Sites
Sources
Also known as GHSA-6mv3-wm7j-h4w5.