Executive brief
Saltcorn is an open-source low-code application builder. Two security flaws in Saltcorn can be chained together to allow an attacker to execute arbitrary commands on the server with just one click: if an administrator visits a malicious link while logged in, the attacker gains the ability to run any operating system command on the server where Saltcorn runs, compromising all data and system integrity.
Technical details
The vulnerability comprises two chained flaws: (1) a reflected XSS in the GET /admin/edit-codepage/:name endpoint where the "name" parameter is inserted into breadcrumbs without HTML sanitization (affecting versions ≥1.1.1), and (2) a command injection in GET /admin/backup where a backup password parameter is unsafely embedded into a shell command via string interpolation (affecting versions ≥1.3.0). An attacker can craft a specially-crafted link that, when clicked by an authenticated admin, executes arbitrary shell commands via the backup function. The attack requires user interaction (clicking a link) and an active admin session, but no special privileges or authentication. The vulnerability affects Saltcorn versions from 1.1.1 through 1.4.1 and was fixed in version 1.5.0-beta.19 via commit 1bf681e, which implements proper output encoding and replaces unsafe exec() calls with spawn().
Affected products
- Saltcorn Saltcorn 1.1.1 through 1.4.1
Timeline
- 2026-01-26: disclosed
- 2026-01-13: patched: Fix committed; patched versions >= 1.5.0-beta.19