# CVE-2025-58363: LF Edge eKuiper path traversal in plugin installation

Source: https://junglewise.ai/threats/cve-2025-58363-lf-edge-ekuiper-path-traversal-in-plugin-installation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-09. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-58363 · Severity: medium · CVSS 5.5 · Published 2026-09-09

eKuiper is an edge computing platform used to process and manage IoT data streams. A path traversal flaw in its plugin installation feature allows attackers with management API access to delete arbitrary files on the server, potentially causing service outages or data loss. The vulnerability only enables deletion, not file creation or modification, but could still disrupt operations if critical system or application files are targeted.

Technologies: [github.com/lf-edge/ekuiper (Go)](https://junglewise.ai/threats/technologies/github-com-lf-edge-ekuiper), [github.com/lf-edge/ekuiper/v2 (Go)](https://junglewise.ai/threats/technologies/github-com-lf-edge-ekuiper-v2), [LF Edge eKuiper](https://junglewise.ai/threats/technologies/ekuiper). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [LF Edge](https://junglewise.ai/threats/vendors/lf-edge).

## Quick answers

**Is CVE-2025-58363 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-58363 being exploited in the wild.

**How severe is CVE-2025-58363?** Medium severity, with a CVSS score of 5.5, published 9 September 2026.

**Which products and versions are affected?** github.com/lf-edge/ekuiper (Go) SEMVER:introduced=0; github.com/lf-edge/ekuiper/v2 (Go) < 2.4.1, SEMVER:introduced=0,fixed=2.4.1; LF Edge eKuiper < 2.4.1.

**Is there a fix for CVE-2025-58363?** Yes. github.com/lf-edge/ekuiper/v2 (Go): upgrade to 2.4.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-58363 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2025-58363?** Check whether you run github.com/lf-edge/ekuiper (Go), github.com/lf-edge/ekuiper/v2 (Go) or LF Edge eKuiper at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/lf-edge/ekuiper/v2 (Go): upgrade to 2.4.1 or later

  ```sh
  go get github.com/lf-edge/ekuiper/v2@v2.4.1
  ```


## Technical details

The vulnerability is a classic path traversal (CWE-22) in the POST /plugins/* endpoint within internal/plugin/native/manager.go. The endpoint constructs a temporary directory path by directly concatenating user-supplied plugin names without proper validation, allowing attackers to inject path traversal sequences (e.g., ../../) that escape the intended plugin directory. When the deferred cleanup operation calls os.RemoveAll on the traversed path, arbitrary directories outside the plugin folder are deleted. The attack requires authentication/access to the management API on port 9081 and is constrained to file/directory deletion only. Patches are available in eKuiper version 2.4.1 and later, which enforce input validation using validate.ValidateID and path.VerifyFileName functions.

## Affected products

- LF Edge eKuiper < 2.4.1

## Identifiers

- CVE-2025-58363
- GHSA-c23q-fw86-9h5x
- GO-2026-6445

## Timeline

- 2026-09-09: disclosed: Advisory published on GitHub
- 2026-09-09: patched: Fix released in eKuiper version 2.4.1

## References

- [https://api.github.com/users/kosmosec](https://api.github.com/users/kosmosec)
- [https://github.com/kosmosec](https://github.com/kosmosec)
- [https://api.github.com/users/kosmosec/gists%7B/gist_id%7D](https://api.github.com/users/kosmosec/gists%7B/gist_id%7D)
- [https://api.github.com/users/kosmosec/repos](https://api.github.com/users/kosmosec/repos)
- [https://avatars.githubusercontent.com/u/15184650?v=4](https://avatars.githubusercontent.com/u/15184650?v=4)
- [https://api.github.com/users/kosmosec/events%7B/privacy%7D](https://api.github.com/users/kosmosec/events%7B/privacy%7D)

## Related threats

- [LF Edge eKuiper SSRF in external service registration](https://junglewise.ai/threats/cve-2025-24979-lf-edge-ekuiper-ssrf-in-external-service-registration)
- [LF Edge eKuiper stored XSS in external service creation](https://junglewise.ai/threats/cve-2025-24978-lf-edge-ekuiper-stored-xss-in-external-service-creation)
- [GO-2025-4158 - LF Edge eKuiper is vulnerable to Arbitrary File Read/Write via unsanitized names and zip extraction in…](https://junglewise.ai/threats/go-2025-4158-lf-edge-ekuiper-is-vulnerable-to-arbitrary-file-read-write-89ee8418)
- [LF Edge eKuiper is vulnerable to Arbitrary File Read/Write via unsanitized names and zip extraction](https://junglewise.ai/threats/lf-edge-ekuiper-is-vulnerable-to-arbitrary-file-read-write-via-6fdf2ea9)
- [GO-2025-3827 - eKuiper API endpoints handling SQL queries with user-controlled table names. in github.com/lf-edge/ekuiper](https://junglewise.ai/threats/cve-2025-54379-pysec-2025-241-lf-edge-ekuiper-is-a-lightweight-iot-data)