CVE-2026-40163
Saltcorn has an Unauthenticated Path Traversal in sync endpoints allows arbitrary file write and directory read
CVSS Score
8.2
EPSS Score
0.1%
EPSS Percentile
23th
Saltcorn is an extensible, open source, no-code database application builder. Prior to 1.4.5, 1.5.5, and 1.6.0-beta.4, the POST /sync/offline_changes endpoint allows an unauthenticated attacker to create arbitrary directories and write a changes.json file with attacker-controlled JSON content anywhere on the server filesystem. The GET /sync/upload_finished endpoint allows an unauthenticated attacker to list arbitrary directory contents and read specific JSON files. This vulnerability is fixed in 1.4.5, 1.5.5, and 1.6.0-beta.4.
| CWE | CWE-22 |
| Vendor | saltcorn |
| Product | saltcorn |
| Published | Apr 10, 2026 |
| Last Updated | Apr 15, 2026 |
Stay Ahead of the Next One
Get instant alerts for saltcorn saltcorn
Be the first to know when new high vulnerabilities affecting saltcorn saltcorn are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
High
Availability
None
Affected Versions
saltcorn / saltcorn
< 1.4.5 >= 1.5.0-beta.0, < 1.5.5 >= 1.6.0-alpha.0, < 1.6.0-beta.4