Executive brief
Erxes is an open-source business operating system used to manage marketing, sales, and customer support. A security flaw in the platform allows a logged-in user to bypass folder restrictions and write files to unauthorized locations on the server. This could allow an attacker to corrupt system files or potentially disrupt business operations.
Technical details
A path traversal vulnerability (CWE-22) exists in Erxes versions prior to 1.6.2. The flaw is located within the 'importHistoriesCreate' GraphQL mutation handler, which fails to properly sanitize file paths provided by the user. An authenticated attacker can exploit this by submitting specially crafted filenames containing traversal sequences (e.g., '../') to write data to arbitrary locations on the host filesystem. This could lead to unauthorized file modification or system instability. The issue was addressed in version 1.6.2 by implementing filename sanitization using the '@erxes/api-utils/src/sanitize-filename' utility.
Affected products
- erxes erxes < 1.6.2
Timeline
- 2024-02-20: patched: Fix committed to repository
- 2025-06-10: disclosed: Vulnerability published via GHSA and NVD