Summary
Bisheng contains a directory traversal vulnerability in the save_download_file function that may allow attacker-controlled file paths to escape the intended storage directory. If an attacker can influence the relevant download or file-saving request, they could cause files to be written to unauthorized locations.
Affected context
The vulnerability occurs in Bisheng's backend cache utility when the save_download_file function constructs a destination path from input that may be influenced by an external requester. Risk is higher when the application accepts untrusted filenames or paths, runs with write access to sensitive directories, or exposes the affected file-saving workflow to remote users.
Exploit preconditions
- Attack surface: Bisheng backend file-download or caching workflow
- Required access: Access to an operation that can influence the saved filename or path; authentication requirements depend on deployment configuration
- Trigger point: Invocation of
save_download_filewhile saving a downloaded or cached file - Why exploitation is possible: Insufficient path boundary enforcement may allow traversal components to resolve the destination outside the intended directory
Why this happens
The underlying bug is improper limitation of a filesystem path derived from potentially untrusted input. When path components are joined or normalized without verifying that the final canonical path remains within an approved base directory, traversal sequences can redirect file operations elsewhere. This behavior maps to CWE-22, Improper Limitation of a Pathname to a Restricted Directory.
Potential impact
- An attacker may overwrite application-managed files
- Sensitive configuration or runtime data could be altered
- Application behavior could be disrupted
- Attackers could create or replace files accessible to the service account
- Further compromise could occur if writable files are later interpreted as executable or trusted content
General mitigation guidance
Mitigation generally focuses on treating all externally influenced filenames
and paths as untrusted and enforcing a strict storage boundary.
Common defensive patterns include:
- Resolving candidate paths canonically and confirming they remain beneath an approved base directory
- Using generated identifiers instead of accepting caller-selected filenames
- Rejecting traversal components, absolute paths, unexpected separators, and platform-specific path syntax
- Applying allowlists for permitted file types and destination locations
- Separating downloaded content from executable, configuration, and application code directories
- Running the service with the minimum filesystem permissions required
- Using controlled temporary storage and restrictive file and directory permissions
How teams detect issues like this
Organizations commonly detect directory traversal risks through:
- Static analysis rules for path joins, filesystem writes, and user-controlled filename flows
- Code review checks for canonicalization followed by base-directory validation
- Tests using traversal sequences, absolute paths, encoded separators, and platform-specific path forms
- Runtime monitoring for writes outside approved cache or upload directories
- Policy enforcement that restricts service-account write access to designated storage locations
Automated code review and software composition analysis tools may help identify
suspicious path-handling patterns, but should be complemented by targeted
security testing.
