Description

4gaBoards is a boards system for realtime project management. Prior to 3.3.8, 4gaBoards allows an authenticated project manager to supply traversal sequences in the filename parameter of GET /exports/:id/:filename. In server/api/controllers/boards/download.js, the decoded inputs.filename value is passed to path.join() beneath private/exports/<user_id>/ without containment validation. A crafted value such as ../ can select an arbitrary file readable by the server process, and the file is returned to the attacker. The fileStream close handler then passes the same path to fs.unlink(), deleting the selected file and potentially causing data loss or denial of service. This issue is fixed in version 3.3.8.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-18T22:16:52.783Z",
  "pubdate": "2026-08-18T22:16:52.783Z",
  "executiveSummary": "An arbitrary file read and deletion vulnerability exists in 4gaBoards prior to version 3.3.8. The vulnerability stems from insufficient input validation of the filename parameter within the GET /exports/:id/:filename endpoint. An authenticated attacker with project manager privileges can supply directory traversal sequences to access, read, and subsequently delete arbitrary files readable by the server process.\nThe flaw exposes the underlying server filesystem to unauthorized data exfiltration and catastrophic data loss through file deletion, leading to potential denial of service conditions. Exploitation requires authentication as a project manager and the ability to interact with the project export functionality.\nThe issue affects 4gaBoards versions prior to 3.3.8 and is remediated in version 3.3.8 by implementing proper path containment validations.",
  "technicalDetails": "The vulnerability resides in the server/api/controllers/boards/download.js component of 4gaBoards, specifically handling requests to the GET /exports/:id/:filename endpoint. The root cause is the direct concatenation and resolution of attacker-controlled input within path.join() without adequate containment validation.\nWhen a request is processed, the decoded inputs.filename parameter is appended beneath the private/exports/<user_id>/ directory. Because the application fails to sanitize or validate that the resulting resolved path remains strictly within the intended export directory, directory traversal sequences such as ../ can be injected.\nAn authenticated project manager can exploit this behavior by crafting a malicious HTTP GET request containing traversal sequences in the filename parameter. This allows the selection of an arbitrary file on the host filesystem that is readable by the underlying Node.js server process.\nUpon successful traversal, the targeted file is read and returned to the attacker in the HTTP response body. Subsequently, the fileStream close handler executes fs.unlink() using the exact same malicious path. This secondary action results in the deletion of the selected file from the server, introducing severe risks of persistent data loss, application corruption, and denial of service.\nPrerequisites for this attack include network access to the target application, authenticated session cookies with project manager privileges, and the ability to invoke the export download API route."
}