What’s Vulnerable › Vulnerabilities
CVE-2026-40163: Saltcorn has an Unauthenticated Path Traversal in sync endpoints allows arbitrary file write and directory read
- Severity: high (CVSS 8.2 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2026-04-10 · updated 2026-06-17
- Weakness: CWE-22
Description
Saltcorn is an extensible, open source, no-code database application builder. Prior to 1.4.5, 1.5.5, and 1.6.0-beta.4, the POST /sync/offline_changes endpoint allows an unauthenticated attacker to create arbitrary directories and write a changes.json file with attacker-controlled JSON content anywhere on the server filesystem. The GET /sync/upload_finished endpoint allows an unauthenticated attacker to list arbitrary directory contents and read specific JSON files. This vulnerability is fixed in 1.4.5, 1.5.5, and 1.6.0-beta.4.
Affected products
- saltcorn: before 1.4.5; from 1.5.0 before 1.5.5; 1.6.0-alpha0, 1.6.0-alpha1, 1.6.0-alpha10, 1.6.0-alpha11, 1.6.0-alpha12, 1.6.0-alpha13 (+15) — fixed in 1.4.5, 1.5.5
How to fix
Upgrade to a fixed version: saltcorn 1.4.5, 1.5.5. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-40163 or the next vulnerability affects your stack