CVE-2026-40163 Saltcorn has an Unauthenticated Path Traversal in sync endpoints allows arbitrary file write and directory read
Unauthenticated attackers can exploit path traversal in Saltcorn sync endpoints to write arbitrary files and read directory contents on the server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-40163?
CVE-2026-40163 is a high-severity path traversal vulnerability in saltcorn, published on 10 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Saltcorn is an extensible, open source, no-code database application builder. Prior to 1.4.5, 1.5.5, and 1.6.0-beta.4, the POST /sync/offline_changes endpoint allows an unauthenticated attacker to create arbitrary directories and write a changes.json file with attacker-controlled JSON content anywhere on the server filesystem. The GET /sync/upload_finished endpoint allows an unauthenticated attacker to list arbitrary directory contents and read specific JSON files. This vulnerability is fixed in 1.4.5, 1.5.5, and 1.6.0-beta.4.
Weakness: CWE-22
Which versions are affected by CVE-2026-40163?
6 open source packages ship an affected version, including @saltcorn/server. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@saltcorn/server npm | All versions | 1.4.5 |
@saltcorn/server npm | All versions | 1.4.5 |
@saltcorn/server npm | From 1.5.0-beta.0 | 1.5.5 |
@saltcorn/server npm | From 1.5.0-beta.0 | 1.5.5 |
@saltcorn/server npm | From 1.6.0-alpha.0 | 1.6.0-beta.4 |
@saltcorn/server npm | From 1.6.0-alpha.0 | 1.6.0-beta.4 |
Products include Saltcorn Saltcorn.
How do I fix CVE-2026-40163?
Upgrade @saltcorn/server to a fixed version for your release line: 1.4.5, 1.5.5 or 1.6.0-beta.4.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-40163 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-40163 exists.
Other vulnerabilities in saltcorn
Sources
Also known as GHSA-32pv-mpqg-h292.