LF Edge eKuiper: Arbitrary File and Directory Deletion via Path Traversal in Plugin Installation Endpoint

CISA KEV lists vulnerabilities known to be exploited. FIRST EPSS estimates the likelihood of exploitation in the next 30 days. An unavailable score does not mean zero risk.

No exploitation or prediction data is available here for these CVEs. This does not mean they are safe or unlikely to be exploited.

### Summary A path traversal vulnerability in eKuiper's administrative management endpoints allows privileged users or attackers with access to management APIs to delete arbitrary files or directories on the host system. ### Details In `internal/plugin/native/manager.go`, the plugin installation endpoint (`POST /plugins/*`) constructs a temporary directory path by directly joining user-supplied resource names (`name`) without sufficient sanitization. Supplying path traversal sequences (such as `../../...`) causes the deferred cleanup operation (`os.RemoveAll`) to target arbitrary directories outside the intended plugin directory. A related issue in configuration and rule lifecycle management where unvalidated rule identifiers could influence file deletion paths was also addressed by introducing unified identifier and file name validation. ### PoC 1. Target file deletion via plugin installation endpoint: ```http POST /plugins/sources HTTP/1.1 Host: 127.0.0.1:9081 Content-Type: application/json { "name": "../../../../../tmp/target.txt", "file": "http://example.com/plugin.zip", "shellParas": [], "functions": [] } ``` 2. When the request finishes, `/tmp/target.txt` is removed by `os.RemoveAll`. ### Impact An attacker with access to eKuiper management APIs can cause arbitrary file or directory deletion, potentially leading to denial of service or disruption of the host environment. This vulnerability provides a delete-only capability and does not permit arbitrary file creation, modification, or code execution. ### Remediation & Patches - **Upgrade to eKuiper >= 2.4.1**: Input validation (`validate.ValidateID`) and file path validation (`path.VerifyFileName`) have been enforced across management endpoints. ### Workarounds - Restrict network access to eKuiper management port (`9081`) via authentication, reverse proxies, and firewall rules. - Run eKuiper with a dedicated non-root user account to limit file system deletion permissions. ### Credits - @kosmosec - @arpitjain099

Source published

9 Sep 2026 17:59:27 UTC

Source modified

17 Sep 2026 17:40:41 UTC

Saved here

24 Oct 2026 13:19:41 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

Source: osv · GitHub Advisory Database · CC-BY-4.0. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H

Publisher rating · MODERATE

LF Edge eKuiper: Arbitrary File and Directory Deletion via Path Traversal in Plugin Installation Endpoint in github.com/lf-edge/ekuiper

Source published

16 Sep 2026 16:56:22 UTC

Source modified

17 Sep 2026 17:30:11 UTC

Saved here

24 Oct 2026 13:19:41 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

Source: osv · OSV · upstream source license applies. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.