Duplicacy restore path traversal (CWE-22) via unsanitized snapshot entry paths

Vulnerability Summary Vulnerability Overview Title: Path traversal in restore via unsanitized snapshot entry paths ID: #692 Status: Open Type: CWE-22 (Path Traversal) Root Cause: During , the tool concatenates the restore directory with the field from the snapshot entry file list without sanitizing . Since snapshot entries are deserialized from remote snapshots, an attacker can craft paths containing (e.g., ), allowing writes to escape the intended restore directory. Scope of Impact Affected Versions: The vulnerability is confirmed in the latest tagged release, v3.2.5, and the HEAD of the branch (as of commit ). Affected Call Sites (all use unsanitized remote snapshot entry paths joined with the restore root directory): 1. The remote-vs-local diff loop in Restore 2. The file download loop in Restore (overwriting inline zero-size file writes and invoking ) 3. The metadata loop in Restore 4. The own path loop in Not Affected: The extra-files cleanup loop in , as its paths originate from local filesystem traversal rather than remote snapshots. Attack Scenario: An attacker who can influence snapshot contents (shared/compressed remote storage backend, malicious backup peer writer, or MITM on unauthenticated storage transport) can write arbitrary files to any location reachable by the user’s OS permissions, including outside the restore directory. Remediation Associated PR: Fix path traversal in restore via unsanitized snapshot entry paths #693 (submitted by carlei, which will close this issue). Fix Strategy: Sanitize/validate at path concatenation points such as to prevent traversal sequences like from escaping the restore root directory. POC / Exploit Code The POC section on the page is marked as “Available upon request.”, and no POC code block is directly displayed. The key code displayed on the page is the wrapper (the function in ): In this function, collapses segments lexicographically but does not prevent the result from escaping the first argument (the restore directory), thereby exposing the vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

Duplicacy restore path traversal (CWE-22) via unsanitized snapshot entry paths

More from this source