CVSS 3.1
8.2 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:NCVE-2026-40163
High (8.2) in saltcorn saltcorn. EPSS 0.3% chance of exploitation in the next 30 days. Fixed in @saltcorn/server 1.4.5, 1.5.5, 1.6.0-beta.4.
Saltcorn is an extensible, open source, no-code database application builder. Prior to 1.4.5, 1.5.5, and 1.6.0-beta.4, the POST /sync/offline_changes endpoint allows an unauthenticated attacker to create arbitrary directories and write a changes.json file with attacker-controlled JSON content anywhere on the server filesystem. The GET /sync/upload_finished endpoint allows an unauthenticated attacker to list arbitrary directory contents and read specific JSON files. This vulnerability is fixed in 1.4.5, 1.5.5, and 1.6.0-beta.4.
Severity
- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 26% of CVEs (scores of 2026-10-31)
- CWE
- CWE-22
- Published
- Modified
- Record from
- the NVD, synced
Affected
- saltcorn:saltcorn
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-32pv-mpqg-h292 | npm | @saltcorn/server | <1.4.5 | 1.4.5 |
| GHSA-32pv-mpqg-h292 | npm | @saltcorn/server | >=1.5.0-beta.0 <1.5.5 | 1.5.5 |
| GHSA-32pv-mpqg-h292 | npm | @saltcorn/server | >=1.6.0-alpha.0 <1.6.0-beta.4 | 1.6.0-beta.4 |