Executive brief
coursevault-preview is a Node.js library for managing course content files. A path traversal vulnerability in the resolveSafe utility allows an attacker to read files outside the intended base directory if a sibling directory with a matching name prefix exists on the filesystem. This could expose sensitive files like configuration data to unauthorized access.
Technical details
The vulnerability is a path traversal (CWE-22) in the resolveSafe utility function in src/utils/errors.ts. The root cause is improper boundary validation: the code uses String.prototype.startsWith(baseDir) to check if a resolved path stays within the base directory, but this is a raw string prefix test rather than a path-boundary test. An attacker controlling the relativePath parameter can bypass this guard by using a payload like "../courses-admin/config.json" when baseDir is "/srv/courses", resulting in the resolved path "/srv/courses-admin/config.json" which passes the flawed prefix check. No network exposure exists; the attack requires local file system access and the presence of a sibling directory whose name shares a prefix with baseDir. The vulnerability is fixed in version 0.1.1 by replacing the check with a separator-aware comparison.
Affected products
- coursevault-preview coursevault-preview < 0.1.1
Timeline
- 2026-04-08: disclosed
- 2026-04-08: patched: Fixed in version 0.1.1