Description
Yank Note before 3.93.1 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files via the path or doc parameter of /api/help. Attackers can supply repeated '../' segments, which bypass the single-replacement sanitization in the publicly allowlisted endpoint, to read SSH keys, configuration, or notes.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
purocean Yank Note
Default version status: unaffected
0 to < 3.93.1affected
pkg:github/purocean/ynReferences
- https://github.com/purocean/yn/issues/543 ↗
- https://github.com/purocean/yn/commit/d3b0ad27f7f6388b878eefd828557ae2d2a8789b ↗
- https://github.com/purocean/yn/blob/v3.93.0/src/main/server/index.ts ↗
- https://github.com/purocean/yn/releases/tag/v3.93.1 ↗
- https://www.vulncheck.com/advisories/yank-note-before-3.93.1-path-traversal-via-api-help-endpoint ↗