# Saltcorn Server arbitrary file and directory listing via build mobile app

Source: https://junglewise.ai/threats/saltcorn-server-arbitrary-file-and-directory-listing-via-build-mobile-9dae5381  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-10-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: low · CVSS 3.1 · Published 2024-10-03

Saltcorn is an open-source web development platform used to build database applications and mobile apps. An authenticated administrator can exploit an unvalidated parameter in the mobile app build feature to list arbitrary filenames and directory names on the server's filesystem, potentially exposing sensitive naming conventions or structure without being able to read file contents.

Technologies: [@saltcorn/server (npm)](https://junglewise.ai/threats/technologies/saltcorn-server). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Low severity, with a CVSS score of 3.1, published 3 October 2024.

**Which products and versions are affected?** @saltcorn/server (npm) SEMVER:introduced=0,fixed=1.0.0-beta.14.

**Is there a fix for This vulnerability?** Yes. @saltcorn/server (npm): upgrade to 1.0.0-beta.14 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network.

**Am I affected?** Check whether you run @saltcorn/server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @saltcorn/server (npm): upgrade to 1.0.0-beta.14 or later

  ```sh
  npm install @saltcorn/server@1.0.0-beta.14
  ```


## Technical details

This is a path traversal and directory listing vulnerability (CWE-548) in the /admin/build-mobile-app/result endpoint. The build_dir_name query parameter is not validated before being used in a path.join() call to construct a directory path, which is then read with readdirSync(). An attacker can supply path traversal sequences (e.g., /../../../../../../../../) to escape the intended mobile_app directory and enumerate files in arbitrary locations. The vulnerability requires admin privileges and allows reading only filenames and directory names, not file contents. The fix validates the build_dir_name parameter format and verifies that the resolved buildDir path starts with the intended root location.

## Affected products

- Saltcorn @saltcorn/server <=1.0.0-beta.13

## Timeline

- 2024-10-03: disclosed
- 2024-10-03: patched: Fixed in version 1.0.0-beta.14

## References

- [https://github.com/saltcorn/saltcorn/security/advisories/GHSA-cfqx-f43m-vfh7](https://github.com/saltcorn/saltcorn/security/advisories/GHSA-cfqx-f43m-vfh7)
- [https://github.com/saltcorn/saltcorn/commit/81adaf78430a9b59804894574d67d2a0c7bb3dc5](https://github.com/saltcorn/saltcorn/commit/81adaf78430a9b59804894574d67d2a0c7bb3dc5)

## Related threats

- [Saltcorn open redirect in login via backslash bypass](https://junglewise.ai/threats/cve-2026-42259-saltcorn-open-redirect-in-login-via-backslash-bypass)
- [Saltcorn reflected XSS and command injection chaining for RCE](https://junglewise.ai/threats/saltcorn-reflected-xss-and-command-injection-chaining-for-rce-91ca3009)
- [Saltcorn Server stored XSS in event logs page](https://junglewise.ai/threats/saltcorn-server-stored-xss-in-event-logs-page-29714f98)
- [Saltcorn Server path traversal in sync endpoint](https://junglewise.ai/threats/cve-2024-47818-saltcorn-server-path-traversal-in-sync-endpoint)
- [Saltcorn Server remote code execution via prototype pollution](https://junglewise.ai/threats/saltcorn-server-remote-code-execution-via-prototype-pollution-4d2c9025)