Warp vulnerable to Path Traversal via Improper validation of Windows paths
High severity
GitHub Reviewed
Published
Jan 31, 2023
to the GitHub Advisory Database
•
Updated Mar 31, 2023
Description
Published to the GitHub Advisory Database
Jan 31, 2023
Reviewed
Jan 31, 2023
Last updated
Mar 31, 2023
Path resolution in
warp::filters::fs::dir
didn't correctly validate Windows paths meaning paths like/foo/bar/c:/windows/web/screen/img101.png
would be allowed and respond with the contents ofc:/windows/web/screen/img101.png
. Thus users could potentially read files anywhere on the filesystem.This only impacts Windows. Linux and other unix likes are not impacted by this.
References