CVE-2026-40163
High · 8.2CVSS
8.2
EPSS
0.4%
Published
Apr 10, 2026
CISA due date
—
The record
Saltcorn is an extensible, open source, no-code database application builder. Prior to 1.4.5, 1.5.5, and 1.6.0-beta.4, the POST /sync/offline_changes endpoint allows an unauthenticated attacker to create arbitrary directories and write a changes.json file with attacker-controlled JSON content anywhere on the server filesystem. The GET /sync/upload_finished endpoint allows an unauthenticated attacker to list arbitrary directory contents and read specific JSON files. This vulnerability is fixed in 1.4.5, 1.5.5, and 1.6.0-beta.4.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @saltcorn/server | 0 | 1.4.5 |
| npm | @saltcorn/server | 1.5.0-beta.0 | 1.5.5 |
| npm | @saltcorn/server | 1.6.0-alpha.0 | 1.6.0-beta.4 |
Related vulnerabilities
- GHSA-32pv-mpqg-h292 Saltcorn has an Unauthenticated Path Traversal in sync endpoints, allowing arbitrary file… Same vulnerability
- CVE-2026-42259 Saltcorn is an extensible, open source, no-code database application builder. Also affects @saltcorn/server
- CVE-2026-41478 Saltcorn is an extensible, open source, no-code database application builder. Also affects @saltcorn/server
- GHSA-f3g8-9xv5-77gv Saltcorn: Open Redirect in `POST /auth/login` due to incomplete `is_relative_url`… Also affects @saltcorn/server
- GHSA-jp74-mfrx-3qvh Saltcorn: SQL Injection via Unparameterized Sync Endpoints (maxLoadedId) Also affects @saltcorn/server
- GHSA-cr3w-cw5w-h3fj Saltcorn's Reflected XSS and Command Injection vulnerabilities can be chained for… Also affects @saltcorn/server
- CVE-2026-81163 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')… CWE-22
- CVE-2026-112049 Vita3K before build 4187 contains a path traversal (zip slip) vulnerability in… CWE-22