Executive brief
Anagnorisis is a media management application that organizes and serves text, images, and videos. An authenticated attacker can bypass directory restrictions to read, write, or move files anywhere on the server where the application has permissions. By exploiting this weakness in combination with template injection, attackers could achieve remote code execution.
Technical details
The vulnerability is an improper pathname validation (CWE-22) across multiple Socket.IO handlers in modules/text/serve.py, modules/images/serve.py, modules/videos/serve.py, and related files. Handlers treat user-supplied paths as if they are already confined to the configured media directory without canonicalizing them, allowing directory traversal attacks. An authenticated user can read arbitrary files, write to arbitrary paths, and inject SSTI payloads into module templates.
Affected products
- volotat Anagnorisis up to 0.4.2
Timeline
- 2026-09-24: disclosed: Publicly disclosed vulnerability
- 2026: other: Vendor was contacted early but did not respond