Threats Tagged 'ghsa-rqrh-8wpv-x7hh'

Note Mark contains a path traversal vulnerability in its migrate export commands due to improper validation of book and note slug inputs. The slug validation uses an unanchored regex pattern that allows strings containing valid characters anywhere, enabling traversal sequences like '../../../../etc/cron.d/x' to pass. During export, these unsanitized slugs are joined into filesystem paths and used to create directories and files outside the intended export directory. Since the export process often runs with root privileges, this can lead to arbitrary file creation with root permissions, potentially enabling code execution.