Executive brief
eKuiper is an edge computing platform used to process and manage IoT data streams. A path traversal flaw in its plugin installation feature allows attackers with management API access to delete arbitrary files on the server, potentially causing service outages or data loss. The vulnerability only enables deletion, not file creation or modification, but could still disrupt operations if critical system or application files are targeted.
Technical details
The vulnerability is a classic path traversal (CWE-22) in the POST /plugins/* endpoint within internal/plugin/native/manager.go. The endpoint constructs a temporary directory path by directly concatenating user-supplied plugin names without proper validation, allowing attackers to inject path traversal sequences (e.g., ../../) that escape the intended plugin directory. When the deferred cleanup operation calls os.RemoveAll on the traversed path, arbitrary directories outside the plugin folder are deleted. The attack requires authentication/access to the management API on port 9081 and is constrained to file/directory deletion only. Patches are available in eKuiper version 2.4.1 and later, which enforce input validation using validate.ValidateID and path.VerifyFileName functions.
Affected products
- LF Edge eKuiper < 2.4.1
Timeline
- 2026-09-09: disclosed: Advisory published on GitHub
- 2026-09-09: patched: Fix released in eKuiper version 2.4.1