Executive brief
Vertex, a tool used for managing video streaming and private tracker content, is vulnerable to a security flaw that allows unauthorized access to system files. An attacker can exploit this to read sensitive information from the server, such as configuration files or system credentials, potentially leading to a full system compromise. This issue affects the privacy of user data and the overall security of the hosting environment.
Technical details
A path traversal vulnerability (CWE-22) exists in Vertex due to improper sanitization of URL paths within the application's routing logic, specifically affecting the '/assets/' endpoint. By using 'dot-dot-slash' (../) sequences in a crafted HTTP request, a remote, unauthenticated attacker can escape the intended web root directory. This allows for the retrieval of sensitive system files, such as '/etc/passwd', from the underlying host. The vulnerability is addressed in commit fbde301b97986d5913fc4bc95f5445750d282e11, which optimizes path error handling and restricts directory traversal.
Affected products
- vertex-app Vertex prior to commit fbde301b97986d5913fc4bc95f5445750d282e11
Timeline
- 2026-05-27: advisory: GitHub Security Advisory GHSA-92j5-qc36-23rr published
- 2026-06-01: disclosed: CVE-2024-40646 published to NVD