Security: Path traversal in received file paths #188

New Issue

2026-07-30T18:34:14+02:00

TapTap commented

2026-07-30 18:34:14 +02:00

Severity: high
Category: security
Location: src/shared/file.c:129-138, src/shared/file.c:328, src/server/server.c:41-55

Description:
Received file paths are used directly to construct destination paths via path_cat(config->receive_root_directory, file->path) without validation. A malicious client can send paths containing .. components, absolute paths (/etc/passwd), or embedded null bytes, causing the server to write outside the intended destination directory.

For example, a client sending path = "../../../etc/cron.d/fastsync" could overwrite system files when the server runs with sufficient privileges.

Suggested fix:

In file_save_to_disk() and receive_incremental_check(), canonicalize and validate the received relative path:
- Reject absolute paths.
- Reject any path component equal to ...
- Reject embedded null bytes.
Resolve the cleaned relative path under the destination root using openat(dest_fd, rel_path, O_NOFOLLOW) or equivalent to prevent symlink traversal.
Consider running the per-connection handler in a chroot or with O_NOFOLLOW flags for destination directories.

Labels: security, path-traversal

**Severity:** high **Category:** security **Location:** `src/shared/file.c:129-138`, `src/shared/file.c:328`, `src/server/server.c:41-55` **Description:** Received file paths are used directly to construct destination paths via `path_cat(config->receive_root_directory, file->path)` without validation. A malicious client can send paths containing `..` components, absolute paths (`/etc/passwd`), or embedded null bytes, causing the server to write outside the intended destination directory. For example, a client sending `path = "../../../etc/cron.d/fastsync"` could overwrite system files when the server runs with sufficient privileges. **Suggested fix:** 1. In `file_save_to_disk()` and `receive_incremental_check()`, canonicalize and validate the received relative path: - Reject absolute paths. - Reject any path component equal to `..`. - Reject embedded null bytes. 2. Resolve the cleaned relative path under the destination root using `openat(dest_fd, rel_path, O_NOFOLLOW)` or equivalent to prevent symlink traversal. 3. Consider running the per-connection handler in a chroot or with `O_NOFOLLOW` flags for destination directories. **Labels:** security, path-traversal

TapTap added the security needs-triage labels 2026-07-30 18:34:14 +02:00

TapTap referenced this issue from a commit

2026-07-30 18:49:31 +02:00

fix: security issues #192 #191 #190 #189 #188 #187

TapTap closed this issue

2026-07-30 19:38:27 +02:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: TapTap/FastSync#188