{"id":"GO-2026-6445","revision":null,"records":[{"revision":"281e3af703c74b59a076a5919919579b","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-c23q-fw86-9h5x","aliases":["CVE-2025-58363","GO-2026-6445"],"title":"LF Edge eKuiper: Arbitrary File and Directory Deletion via Path Traversal in Plugin Installation Endpoint","description":"### Summary\nA path traversal vulnerability in eKuiper's administrative management endpoints allows privileged users or attackers with access to management APIs to delete arbitrary files or directories on the host system.\n\n### Details\nIn `internal/plugin/native/manager.go`, the plugin installation endpoint (`POST /plugins/*`) constructs a temporary directory path by directly joining user-supplied resource names (`name`) without sufficient sanitization. Supplying path traversal sequences (such as `../../...`) causes the deferred cleanup operation (`os.RemoveAll`) to target arbitrary directories outside the intended plugin directory.\n\nA related issue in configuration and rule lifecycle management where unvalidated rule identifiers could influence file deletion paths was also addressed by introducing unified identifier and file name validation.\n\n### PoC\n1. Target file deletion via plugin installation endpoint:\n```http\nPOST /plugins/sources HTTP/1.1\nHost: 127.0.0.1:9081\nContent-Type: application/json\n\n{\n  \"name\": \"../../../../../tmp/target.txt\",\n  \"file\": \"http://example.com/plugin.zip\",\n  \"shellParas\": [],\n  \"functions\": []\n}\n```\n2. When the request finishes, `/tmp/target.txt` is removed by `os.RemoveAll`.\n\n### Impact\nAn attacker with access to eKuiper management APIs can cause arbitrary file or directory deletion, potentially leading to denial of service or disruption of the host environment. This vulnerability provides a delete-only capability and does not permit arbitrary file creation, modification, or code execution.\n\n### Remediation & Patches\n- **Upgrade to eKuiper >= 2.4.1**: Input validation (`validate.ValidateID`) and file path validation (`path.VerifyFileName`) have been enforced across management endpoints.\n\n### Workarounds\n- Restrict network access to eKuiper management port (`9081`) via authentication, reverse proxies, and firewall rules.\n- Run eKuiper with a dedicated non-root user account to limit file system deletion permissions.\n\n### Credits\n- @kosmosec\n- @arpitjain099","state":0,"publishedAt":"2026-09-09T17:59:27+00:00","modifiedAt":"2026-09-17T17:40:41.0509108+00:00","affected":[{"ecosystem":"Go","name":"github.com/lf-edge/ekuiper/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"2.4.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/lf-edge/ekuiper/security/advisories/GHSA-c23q-fw86-9h5x","https://github.com/lf-edge/ekuiper","https://github.com/lf-edge/ekuiper/releases/tag/v2.4.1"],"sourceUrl":"https://github.com/advisories/GHSA-c23q-fw86-9h5x","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-c23q-fw86-9h5x","identifiers":["GHSA-c23q-fw86-9h5x","CVE-2025-58363","GO-2026-6445"]},"retained":false,"historicalAffected":[]},{"revision":"7c8ecbcb0d694db29af6980bd126c4e7","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6445","aliases":["CVE-2025-58363","GHSA-c23q-fw86-9h5x"],"title":"LF Edge eKuiper: Arbitrary File and Directory Deletion via Path Traversal in Plugin Installation Endpoint in github.com/lf-edge/ekuiper","description":"LF Edge eKuiper: Arbitrary File and Directory Deletion via Path Traversal in Plugin Installation Endpoint in github.com/lf-edge/ekuiper","state":0,"publishedAt":"2026-09-16T16:56:22+00:00","modifiedAt":"2026-09-17T17:30:11.2627728+00:00","affected":[{"ecosystem":"Go","name":"github.com/lf-edge/ekuiper","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/lf-edge/ekuiper/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"2.4.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/lf-edge/ekuiper/security/advisories/GHSA-c23q-fw86-9h5x","https://github.com/lf-edge/ekuiper/releases/tag/v2.4.1"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6445","license":"OSV · upstream source license applies","key":"osv:GO-2026-6445","identifiers":["GO-2026-6445","CVE-2025-58363","GHSA-c23q-fw86-9h5x"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-13T07:09:48.0434594+00:00","complete":true,"records":1779,"lastAttemptAt":"2026-11-13T07:09:48.0434594+00:00","lastSuccessAt":"2026-11-13T07:09:48.3275958+00:00","error":null,"lastVerifiedAt":"2026-11-13T07:09:48.3277431+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-d8fa82e95fdb59244e2f635e667ba17f0796ca0a4f1f4bb8cc31febcd660b76c-c5309b25400581525e35b5d686fde5eb801ba52451edf64385de1067c7c5e97b","complete":true,"records":424978,"lastAttemptAt":"2026-11-13T07:09:47.3634648+00:00","lastSuccessAt":"2026-11-13T06:55:18.981967+00:00","error":null,"lastVerifiedAt":"2026-11-13T07:09:47.3634648+00:00","snapshotPublishedAt":"2026-11-13T06:26:49+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-c400362982e04b6aa54109c6b458794c","complete":false,"records":13793,"lastAttemptAt":"2026-11-13T07:19:26.5908907+00:00","lastSuccessAt":"2026-11-13T07:19:26.552+00:00","error":"356 identifier lookups failed; latest failures include AccessDenied (HTTP 403). Other identifiers were checked independently.","lastVerifiedAt":"2026-11-13T07:19:26.552+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13490,"expectedIdentifiers":13846,"failedIdentifiers":356},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-13T07:09:48.0434594+00:00","complete":true,"records":1123,"lastAttemptAt":"2026-11-13T07:09:48.0434594+00:00","lastSuccessAt":"2026-11-13T07:09:48.4741485+00:00","error":null,"lastVerifiedAt":"2026-11-13T07:09:48.4741489+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-dad46f90d10c4b5890012c0a64d342dc","complete":true,"records":13793,"lastAttemptAt":"2026-11-13T07:09:49.8746887+00:00","lastSuccessAt":"2026-11-13T06:18:21.149+00:00","error":null,"lastVerifiedAt":"2026-11-13T06:18:21.149+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13846,"expectedIdentifiers":13846,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-93e76d404e1aeb6a7e8902f5ffa06211fc86dea3b1958e297abb2668aa5e6e8c","complete":true,"records":9952,"lastAttemptAt":"2026-11-13T07:09:47.7322763+00:00","lastSuccessAt":"2026-11-12T23:19:15.5239119+00:00","error":null,"lastVerifiedAt":"2026-11-13T07:09:47.7322763+00:00","snapshotPublishedAt":"2026-11-12T23:03:02+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-4d60731753a2f72e455d1086e7203d0ef10843936dcc1cf2b45135e2caa204b0","complete":true,"records":2012,"lastAttemptAt":"2026-11-13T07:09:47.5190756+00:00","lastSuccessAt":"2026-11-12T18:16:50.7862525+00:00","error":null,"lastVerifiedAt":"2026-11-13T07:09:47.5190756+00:00","snapshotPublishedAt":"2026-11-12T17:48:11+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-20d1a8ab073a1c13ab2143dbcadb34ebb8edf1e18e16482b448513662c3d1e12","complete":true,"records":3127,"lastAttemptAt":"2026-11-13T07:09:47.8377123+00:00","lastSuccessAt":"2026-11-12T22:18:31.0338213+00:00","error":null,"lastVerifiedAt":"2026-11-13T07:09:47.8377123+00:00","snapshotPublishedAt":"2026-11-12T22:18:06+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-178522b1ccf3a779bfdc323be85feb949f35ae83fc129db130584901ae0094bb","complete":true,"records":231768,"lastAttemptAt":"2026-11-13T07:09:47.6322837+00:00","lastSuccessAt":"2026-11-13T06:57:00.764342+00:00","error":null,"lastVerifiedAt":"2026-11-13T07:09:47.6322837+00:00","snapshotPublishedAt":"2026-11-13T06:32:53+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}