Executive brief
welcomyzt is a simple file server utility used for local development and testing. The vulnerability allows attackers to access arbitrary files on the system by manipulating file paths with directory traversal sequences (../ patterns), potentially exposing sensitive files like system configuration, credentials, or application source code.
Technical details
welcomyzt contains a path traversal vulnerability (CWE-22) in its file serving mechanism. The vulnerability occurs because the server does not properly sanitize or validate file path inputs, allowing attackers to use "../" sequences in HTTP requests to navigate outside the intended document root. An unauthenticated attacker on the network can send specially crafted GET requests (e.g., GET /../../etc/passwd) to read arbitrary files from the host system. The attack requires no authentication or user interaction and is trivial to exploit. No patch is available; the advisory recommends using the package only for local development.
Affected products
- welcomyzt welcomyzt 0.0.0 and later
Timeline
- 2017-05: disclosed: Vulnerability originally discovered; example request dated May 4, 2017
- 2020-09-01: advisory: GHSA advisory published