Description

A vulnerability was identified in blackms aistack up to 1.6.1. Affected by this issue is some unknown functionality of the file src/web/server.ts of the component Static File Handler. Such manipulation of the argument req.url leads to path traversal. The attack can be executed remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-27T13:18:41.497Z",
  "pubdate": "2026-08-27T13:18:41.497Z",
  "executiveSummary": "A path traversal vulnerability exists in the blackms aistack framework within the Static File Handler component, specifically affecting versions up to 1.6.1.\nThe vulnerability arises from improper sanitization of the req.url argument in src/web/server.ts, allowing remote attackers to access arbitrary files outside the intended web root directory.\nThe risk is critical due to the potential for unauthorized disclosure of sensitive system files, configuration data, or source code.\nExploitation does not require authentication and can be performed remotely by submitting crafted HTTP requests containing directory traversal sequences (e.g., ../).\nA public exploit is currently available, increasing the likelihood of malicious utilization.\nThe maintainers of the project have been notified via an issue report but have not yet provided a response or a patch to remediate the identified weakness.",
  "technicalDetails": "The vulnerability resides within the Static File Handler component of blackms aistack, specifically located in the src/web/server.ts file. The root cause is the insecure handling of the req.url property, which is processed without adequate input validation or canonicalization before being utilized in file system operations.\nIn a typical deployment, the Static File Handler is responsible for serving static assets. The vulnerability manifests when the application uses the raw request URL to resolve paths on the underlying host filesystem. By incorporating directory traversal sequences, such as '../', into the req.url argument, an attacker can escape the intended document root.\nThe attack flow follows a predictable pattern: 1) The attacker initiates an HTTP request to the target server, manipulating the URL path to include traversal sequences (e.g., GET /../../etc/passwd). 2) The vulnerable code in src/web/server.ts fails to normalize the path or validate that the resulting path remains within the predefined directory boundaries. 3) The underlying Node.js filesystem API processes the traversal path, resolving it to a location outside the web root. 4) The application reads the content of the unintended file and returns it in the HTTP response body.\nThis vulnerability is classified as a Path Traversal, allowing for unauthorized file disclosure. Because the component performs no checks against path normalization, an attacker can access any file accessible to the user account running the blackms aistack process. This could result in the exposure of environment variables, database credentials, system configuration files, or sensitive application source code.\nThere are no authentication or privilege requirements to trigger this vulnerability, as the Static File Handler is typically exposed to unauthenticated network traffic. The exposure is fully remote, and the existence of public exploit code lowers the barrier to entry for unauthorized actors. The defect persists across all versions of blackms aistack up to and including 1.6.1."
}