Description

A vulnerability was detected in Lspace-io lspace-server up to 79f02fe5aa8970b210a6a05cf097155f8d9ffd71. This issue affects the function fileExists/readFile/writeFile/deleteFile of the file src/core/repository.ts of the component Repositories File API. Performing a manipulation of the argument filePath results in path traversal. The attack is only possible with local access. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-06T22:16:52.560Z",
  "pubdate": "2026-08-06T22:16:52.560Z",
  "executiveSummary": "A path traversal vulnerability has been identified in the Repositories File API component of Lspace-io lspace-server, specifically affecting the functions fileExists, readFile, writeFile, and deleteFile within the source file src/core/repository.ts. This security flaw arises from inadequate validation of the filePath argument supplied by users, allowing malicious actors to traverse the directory structure outside the intended operational root.\nThe impact of successful exploitation includes unauthorized read, write, and delete operations on arbitrary files within the underlying host filesystem, depending on the specific function invoked and the permissions of the running application process. This poses severe risks to data confidentiality, integrity, and system availability.\nThe vulnerability affects Lspace-io lspace-server up to commit 79f02fe5aa8970b210a6a05cf097155f8d9ffd71. Exploitation of this flaw requires local access to the system. Because the project utilizes continuous delivery with rolling releases, specific version numbers for affected or patched releases are unavailable, and the vendor has not yet responded to early issue reports.",
  "technicalDetails": "The vulnerability resides in the src/core/repository.ts file of the Repositories File API component in Lspace-io lspace-server. Specifically, the functions fileExists, readFile, writeFile, and deleteFile fail to properly sanitize or validate the filePath argument before interacting with the host filesystem. This root cause allows sequence injection characters, such as directory traversal sequences (e.g., ../), to be successfully interpreted by file system operations.\nExploitation of this vulnerability requires local access to the target host running the lspace-server component. An attacker with local access can manipulate the filePath parameter passed to the vulnerable Repositories File API endpoints or internal function calls. By injecting crafted relative path sequences into the filePath argument, the attacker can break out of the intended repository sandbox directory.\nThe attack flow proceeds as follows: First, the attacker identifies an interaction vector that invokes one of the vulnerable functions (fileExists, readFile, writeFile, or deleteFile). Second, the attacker crafts a malicious input containing path traversal sequences directed at sensitive system or application files. Third, the unvalidated filePath argument is processed by the underlying Node.js or operating system file APIs within src/core/repository.ts. Finally, the application performs the requested read, write, file existence check, or deletion operation on the unintended target file.\nDepending on the targeted function and execution context, the post-exploitation impact ranges from reading sensitive configuration or system files via readFile, corrupting or overwriting critical system files via writeFile, verifying the existence of arbitrary files via fileExists, to causing denial of service or data loss by removing arbitrary files via deleteFile. Network exposure is constrained by the local access requirement, but local privilege escalation or unauthorized data exposure scenarios remain viable if other local threat vectors exist."
}