Path Traversal File Read Vulnerability in @blackms/aistack

1) CNA / Submission Type

• Submission type: Report a vulnerability (CVE ID request)
• Reporter role: Independent security researcher
• Report date: Jul 8, 2026

2) Reporter Contact

• Reporter name: cccccccti
• Reporter email: ccccccc_Ti@outlook.com
• Permission to share contact with vendor: Yes

3) Vendor / Product Identification

• Vendor: blackms
• Product: @blackms/aistack
• Repository: https://github.com/blackms/aistack
• Affected component(s):
• src/web/server.ts

4) Vulnerability Type

• CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory)
• Short title: Path traversal in static file serving

5) Affected Versions

• Confirmed affected: 1.6.1 (dda4ae3 confirmed affected)
• Suspected affected range: revisions containing the same request-to-sink flows listed below
• Fixed version: Not available at time of report

6) Vulnerability Description

A path traversal file read vulnerability has been identified in the web server component of @blackms/aistack. The static file handler takes req.url, joins it with the frontend build directory, and then reads the resulting path with fs.readFileSync. The implementation does not show a final canonical containment check proving that the normalized file path remains inside the static directory. An attacker who can reach the local web server can request traversal paths that cause the process to read files outside the intended static asset root. Manual reproduction was confirmed before this report was generated. The commit dda4ae3 is confirmed affected, with no fixed version available at the time of reporting.

7) Technical Root Cause

1. js/file-access-from-request
   • Source: src/web/server.ts:257 (req.url)
   • Path construction: src/web/server.ts:275
   • Code: let filePath = path.join(staticDir, url);
   • Sink: src/web/server.ts:313
   • Sink code: const content = fs.readFileSync(filePath);

8) Attack Prerequisites

• Attacker can send HTTP requests to the affected web server.
• The requested traversal target exists and is readable by the server process.
• No reverse proxy or routing layer normalizes or blocks traversal payloads before they reach serveStatic.

9) Proof of Concept / Reproduction Guidance

This proof of concept provides a concise, CVE-style reproduction example for the reported issue.

1. Reproduction request

GET /..%2f..%2f..%2fpackage.json HTTP/1.1
Host: 127.0.0.1:<port>

2. Validation

• Start the affected web server.
• Request a known static asset to confirm normal behavior.
• Send an encoded traversal request for a known file outside web/dist.
• Confirm that the response contains the out-of-bound file content or otherwise proves the file was read by the server process.

10) Security Impact

• Confidentiality: High (files readable by the web server process can be disclosed over HTTP).
• Integrity: None for the documented read path.
• Availability: Low if repeated large file reads consume resources.
• Scope: Unchanged.

11) CVSS v3.1 Suggestion

• Suggested vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
• Suggested base score: 8.2 (High)
• Adjust PR upward if the vulnerable tools are strictly admin-only and strongly authenticated.

12) Workarounds / Mitigations

• Serve static files through a hardened static-file middleware that enforces root containment.
• Decode, normalize, and canonicalize request paths before filesystem access.
• Reject traversal sequences, absolute paths, encoded traversal variants, and symlink escapes.
• Add authentication or bind the web server to trusted interfaces when appropriate.

13) Recommended Fix

• Eliminate the request-to-sink data flow documented above.
• Resolve the candidate file path and verify it remains inside staticDir after normalization and symlink resolution.
• Return 403 for any path outside the static root.
• Add regression tests for encoded and double-encoded traversal payloads.
• Publish a maintainer security advisory once a patch is released.

14) References

• Repository: https://github.com/blackms/aistack
• Reviewed source file: src/web/server.ts
• CWE-22: https://cwe.mitre.org/data/definitions/22.html

15) Credits

• Discoverer: cccccccti
• Discovery method: Static analysis (CodeQL) plus repository source-code audit and manual reproduction

16) Additional Notes for Form Mapping

• Audit verdict: Likely exploitable: attacker-controlled HTTP request paths can reach a filesystem read sink outside the static root.
• Dynamic exploit replay status: manually reproduced by the reporter before report generation.
• Maintainer should validate release mapping before coordinated disclosure.