CVE-2025-58363

LF Edge eKuiper: Arbitrary File and Directory Deletion via Path Traversal in Plugin Installation Endpoint

CVSS_V3 Publisher rating MODERATEFixed by github.com/lf-edge/ekuiper/v2 2.4.1osv · severity unknownFixed by github.com/lf-edge/ekuiper/v2 2.4.1KEV status unknown

Original advisory

osv · GHSA-c23q-fw86-9h5x

Published

### Summary A path traversal vulnerability in eKuiper's administrative management endpoints allows privileged users or attackers with access to management APIs to delete arbitrary files or directories on the host system. ### Details In `internal/plugin/native/manager.go`, the plugin installation endpoint (`POST /plugins/*`) constructs a temporary directory path by directly joining user-supplied resource names (`name`) without sufficient sanitization. Supplying path traversal sequences (such as `../../...`) causes the deferred cleanup operation (`os.RemoveAll`) to target arbitrary directories outside the intended plugin directory. A related issue in configuration and rule lifecycle management where unvalidated rule identifiers could influence file deletion paths was also addressed by introducing unified identifier and file name validation. ### PoC 1. Target file deletion via plugin installation endpoint: ```http POST /plugins/sources HTTP/1.1 Host: 127.0.0.1:9081 Content-Type: application/json { "name": "../../../../../tmp/target.txt", "file": "http://example.com/plugin.zip", "shellParas": [], "functions": [] } ``` 2. When the request finishes, `/tmp/target.txt` is removed by `os.RemoveAll`. ### Impact An attacker with access to eKuiper management APIs can cause arbitrary file or directory deletion, potentially leading to denial of service or disruption of the host environment. This vulnerability provides a delete-only capability and does not permit arbitrary file creation, modification, or code execution. ### Remediation & Patches - **Upgrade to eKuiper >= 2.4.1**: Input validation (`validate.ValidateID`) and file path validation (`path.VerifyFileName`) have been enforced across management endpoints. ### Workarounds - Restrict network access to eKuiper management port (`9081`) via authentication, reverse proxies, and firewall rules. - Run eKuiper with a dedicated non-root user account to limit file system deletion permissions. ### Credits - @kosmosec - @arpitjain099

Read the publisher's advisory

osv · GO-2026-6445

Published

LF Edge eKuiper: Arbitrary File and Directory Deletion via Path Traversal in Plugin Installation Endpoint in github.com/lf-edge/ekuiper

Read the publisher's advisory

Affected versions, risk and source history

Exploitation and risk

Source status

CISA KEV lists vulnerabilities known to be exploited. FIRST EPSS estimates the likelihood of exploitation in the next 30 days. An unavailable score does not mean zero risk.

Which CVEs have scores here?

This view includes predictions for CVE identifiers explicitly listed in public NuGet advisories. Microsoft release pages have their own prediction coverage. Check source status for the scope and latest checks.

No exploitation or prediction data is available here for these CVEs. This does not mean they are safe or unlikely to be exploited.

Risk history

Compare earlier KEV listings and daily EPSS scores. Advisory wording and affected versions have a separate history.

When does an EPSS score appear as a change?

A prediction change is reported when EPSS rises from below 10% to 10% or higher. Other daily score changes remain in this history.

Advisory history

2 saved versions

See how the publisher's advisory changed over time. Each link opens the version saved at that time. The publisher's update date can differ from the date shown here.

How advisory history works

Each link identifies one complete publisher record. History can include advisories that previously shared an identifier; an identifier removed by a publisher no longer establishes a current relationship. A historical link shows only that record and earlier saved versions. Failed checks and unchanged reads do not create new versions.

24 Oct 2026 13:19:41 UTC