Executive brief
Mihomo, a popular proxy core, contains a security flaw that allows users with basic access to read sensitive files from the underlying server. Because the software often runs with high-level system permissions, an attacker could steal critical data like system passwords or configuration secrets. This could lead to a full system compromise or unauthorized access to other parts of the network.
Technical details
An arbitrary file read vulnerability exists in mihomo <= v1.19.11 due to missing path validation in the 'rule-providers' configuration parser. Specifically, in 'rules/provider/parse.go', the 'file' type branch fails to enforce 'IsSafePath' constraints, allowing attackers to provide absolute paths to sensitive system files (e.g., /etc/shadow). When the application attempts to parse these files as rule data, it fails and emits the file's contents into the application logs. An authenticated attacker with access to the external controller API can inject a malicious configuration via '/configs' and then retrieve the leaked file fragments by monitoring the '/logs' endpoint.
Affected products
- MetaCubeX mihomo <= v1.19.11
Timeline
- 2025-11-18: disclosed
- 2025-11-18: advisory