CVE-2017-6200

Name of the Vulnerable Software and Affected Versions Sandstorm before build 0.203

Description The issue allows remote attackers to read any specified file under /etc or /run via the sandbox backup function. This is due to the findFilesToZip function not filtering Line Feed ( ) characters in a directory name.

Recommendations For Sandstorm before build 0.203, update to build 0.203 or later to resolve the issue. As a temporary workaround, consider restricting access to the sandbox backup function until a patch is available.