Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Critical severity, with a CVSS score of 10, published 10 April 2026.

Which products and versions are affected?

Daptin <= 0.11.3; github.com/daptin/daptin (Go) <= 0.11.3.

Is there a fix for This vulnerability?

A patch was published on 2026-04-05: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run Daptin or github.com/daptin/daptin (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Daptin path traversal and Zip Slip in cloudstore file upload

Q: Which products and versions are affected?

Daptin <= 0.11.3; github.com/daptin/daptin (Go) <= 0.11.3.

Q: Is there a fix for This vulnerability?

A patch was published on 2026-04-05: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is This vulnerability attacked?

It is attacked over the network, in a software library.

Q: Am I affected?

Check whether you run Daptin or github.com/daptin/daptin (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Severity: critical · CVSS 10 · Published 2026-04-10

Daptin, an open-source backend-as-a-service platform, contains a critical security flaw in its file upload functionality. An unauthenticated attacker can upload specially crafted files to overwrite sensitive system files or place malicious code on the server. This could lead to a complete system takeover, data loss, or permanent disruption of services.

Technologies: Daptin, github.com/daptin/daptin (Go). Vendors: Daptin, Go.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Critical severity, with a CVSS score of 10, published 10 April 2026.
Which products and versions are affected?: Daptin <= 0.11.3; github.com/daptin/daptin (Go) <= 0.11.3.
Is there a fix for This vulnerability?: A patch was published on 2026-04-05: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run Daptin or github.com/daptin/daptin (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal and 'Zip Slip' vulnerability exists in Daptin's `cloudstore.file.upload` action within `server/actions/action_cloudstore_file_upload.go`. The application fails to validate user-supplied filenames before writing them to disk, allowing attackers to use '..' sequences to escape the intended upload directory. This can be exploited by unauthenticated remote attackers to perform arbitrary file writes. By overwriting critical system files or uploading executable scripts, an attacker can achieve remote code execution (RCE). The vulnerability is addressed in version 0.12.0 by implementing path cleaning and prefix validation.

Affected products

Daptin Daptin <= 0.11.3

Timeline

2026-04-05: patched: Fix committed to repository
2026-04-10: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.