Summary
WookTeam v1.6.6 and earlier contain a directory traversal vulnerability in the project task export endpoint. An attacker who can reach the endpoint may cause the server to download files outside the intended storage directory, including any files readable by the web server process.
WookTeam v1.6.6 and earlier contain a directory traversal vulnerability in the project task export endpoint. An attacker who can reach the endpoint may cause the server to download files outside the intended storage directory, including any files readable by the web server process.
Affected context
The issue occurs in WookTeam deployments where the project task export endpoint accepts a file reference through the data parameter and uses that value to construct a download path. Risk is present when the supplied path is not normalized and is not restricted to the intended storage directory, while the web server process has read access to sensitive files.
The issue occurs in WookTeam deployments where the project task export endpoint accepts a file reference through the data parameter and uses that value to construct a download path. Risk is present when the supplied path is not normalized and is not restricted to the intended storage directory, while the web server process has read access to sensitive files.
Exploit preconditions
- Attack surface: The project task export HTTP endpoint at
/api/project/task/export - Required access: Ability to reach the endpoint; additional authentication or authorization requirements depend on deployment configuration
- Trigger point: Processing the file value supplied through the endpoint's
dataparameter - Why exploitation is possible: User-controlled path data is passed into file-path construction without effective normalization or directory-boundary validation
- Attack surface: The project task export HTTP endpoint at
/api/project/task/export - Required access: Ability to reach the endpoint; additional authentication or authorization requirements depend on deployment configuration
- Trigger point: Processing the file value supplied through the endpoint's
dataparameter - Why exploitation is possible: User-controlled path data is passed into file-path construction without effective normalization or directory-boundary validation
Why this happens
The underlying bug is the use of an externally influenced file path in a download operation without enforcing confinement to the intended storage directory. Directly concatenating the supplied value into a filesystem path allows traversal components to escape the permitted directory. This behavior maps to CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal.
The underlying bug is the use of an externally influenced file path in a download operation without enforcing confinement to the intended storage directory. Directly concatenating the supplied value into a filesystem path allows traversal components to escape the permitted directory. This behavior maps to CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal.
Potential impact
- Sensitive application, configuration, or system files may be disclosed
- Credentials, tokens, or private keys readable by the web server process could be exposed
- Attackers could gain information useful for further compromise
- Organizational or user data stored on the server may be accessed without authorization
- Sensitive application, configuration, or system files may be disclosed
- Credentials, tokens, or private keys readable by the web server process could be exposed
- Attackers could gain information useful for further compromise
- Organizational or user data stored on the server may be accessed without authorization
General mitigation guidance
Mitigation generally focuses on treating file references as untrusted identifiers and enforcing a strict directory trust boundary.
Common defensive patterns include:
- Resolve candidate paths against a fixed storage root and verify that the canonical result remains within that root
- Prefer opaque file identifiers or server-side allowlists over client-supplied filesystem paths
- Reject traversal components, absolute paths, and unexpected path formats as an additional validation layer
- Use framework file-download mechanisms that support constrained storage disks or equivalent sandboxing
- Run the web server with least-privilege filesystem permissions and limit access to sensitive directories
- Apply authorization checks so exported files are available only to permitted users and projects
Mitigation generally focuses on treating file references as untrusted identifiers and enforcing a strict directory trust boundary.
Common defensive patterns include:
- Resolve candidate paths against a fixed storage root and verify that the canonical result remains within that root
- Prefer opaque file identifiers or server-side allowlists over client-supplied filesystem paths
- Reject traversal components, absolute paths, and unexpected path formats as an additional validation layer
- Use framework file-download mechanisms that support constrained storage disks or equivalent sandboxing
- Run the web server with least-privilege filesystem permissions and limit access to sensitive directories
- Apply authorization checks so exported files are available only to permitted users and projects
How teams detect issues like this
Organizations can identify path traversal risks through:
- Static analysis rules for user-controlled values reaching filesystem APIs, path joins, or download responses
- Code review checks for string concatenation involving file paths and missing canonicalization or containment checks
- Tests that verify export and download features cannot access files outside approved directories
- Web application policies and monitoring for traversal-like path input, abnormal file-download requests, and access to sensitive paths
- Automated security review tools that flag untrusted input flowing into file access operations
Organizations can identify path traversal risks through:
- Static analysis rules for user-controlled values reaching filesystem APIs, path joins, or download responses
- Code review checks for string concatenation involving file paths and missing canonicalization or containment checks
- Tests that verify export and download features cannot access files outside approved directories
- Web application policies and monitoring for traversal-like path input, abnormal file-download requests, and access to sensitive paths
- Automated security review tools that flag untrusted input flowing into file access operations
Sources
| Source | Link |
|---|---|
| github. | github.com/ |
