Description

A path traversal vulnerability in cube-root/directory-serve through 1.3.7 allows an unauthenticated remote attacker to delete arbitrary files outside the intended served directory when the application is run with the --delete option. The lib/middleware/file-remove.js middleware does not sanitize the req.query.file parameter before using it to construct file system paths, enabling directory traversal via ../ sequences.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-10T11:17:29.503Z",
  "pubdate": "2026-08-10T11:17:29.503Z",
  "executiveSummary": "A path traversal vulnerability exists in cube-root/directory-serve through 1.3.7, specifically within the file removal middleware. This security flaw allows an unauthenticated remote attacker to execute arbitrary file deletion operations outside the intended served directory boundary when the application is executed with the --delete option. The underlying issue stems from a failure to properly sanitize user-supplied input utilized in file system path construction. Successful exploitation results in unauthorized deletion of critical system files or application data, severely impacting system integrity and availability. The attack vector is remotely exploitable over the network without requiring authentication, presenting a critical risk to exposed instances operating with the file deletion capability enabled. Mitigation requires addressing the input validation deficiency within the affected middleware component.",
  "technicalDetails": "The vulnerability resides in the lib/middleware/file-remove.js middleware component of cube-root/directory-serve through 1.3.7. The root cause of the issue is the direct and unsanitized ingestion of the req.query.file parameter. When the application is launched with the --delete option, this parameter is utilized directly in the construction of file system paths for deletion operations without implementing adequate path traversal defenses or normalization checks. Consequently, an unauthenticated remote attacker can inject directory traversal sequences such as '../' into the req.query.file query parameter.\nThe step-by-step attack flow proceeds as follows: First, the remote attacker identifies a target instance of cube-root/directory-serve running with the --delete command-line flag enabled, exposing the file removal functionality over the network. Second, the attacker crafts an HTTP request containing malicious traversal sequences within the file query parameter, designed to traverse upward from the intended base directory to arbitrary locations on the host file system. Third, the unauthenticated HTTP request is processed by the vulnerable lib/middleware/file-remove.js middleware. Fourth, the middleware constructs the target file path by appending the unsanitized input to the base directory path. Fifth, because the input lacks sanitization or validation to restrict the path to the designated root, the operating system resolves the traversal sequences, pointing the deletion routine to an arbitrary file location outside the served directory. Finally, the application executes the file deletion operation against the resolved target, leading to the permanent loss of the targeted file.\nThe affected component is lib/middleware/file-remove.js in all versions through 1.3.7 of cube-root/directory-serve. Exploitation requires network access to the running application, no authentication, and the explicit activation of the --delete application runtime flag. The post-exploitation impact includes the localized denial of service and system instability resulting from the unauthorized deletion of arbitrary system or application files."
}