HSEC-2025-0004 Broken Path Sanitization in spacecookie Library
Broken path sanitization in the spacecookie library allows attackers to bypass traversal protections and access or modify arbitrary files.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is HSEC-2025-0004?
HSEC-2025-0004 is a path traversal vulnerability in spacecookie, published on 14 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Broken Path Sanitization in spacecookie Library
The spacecookie library exposes the functions sanitizePath and sanitizeIfNotUrl intended to
remove .. components from paths which can be used to prevent path traversal attacks. Due to
erroneous comparison code, this elimination is not actually performed which has been remedied
in version 1.0.0.3 by properly comparing using equalFilePath.
Any user of those respective functions of any version of spacecookie should upgrade to 1.0.0.3
or later. Note that the spacecookie server executable included in the same package is not affected
by the problem since a separate check would reject any malicious path that gets by sanitizePath.
Which versions are affected by HSEC-2025-0004?
1 open source package ship an affected version, including spacecookie.
| Package | Affected | Fixed in |
|---|---|---|
spacecookie Hackage | From 0.2.0.0 | 1.0.0.3 |
How do I fix HSEC-2025-0004?
Upgrade spacecookie to 1.0.0.3 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is HSEC-2025-0004 being exploited?
There is no known exploitation of HSEC-2025-0004 in the wild and no public exploit code.