CVE-2026-113651

Name of the Vulnerable Software and Affected Versions uploadfs versions prior to 1.28.0

Description The local storage backend of the uploadfs library fails to properly validate or sanitize user-supplied paths. The prefixPath() function only removes double slashes and does not normalize paths or reject parent-directory segments. Consequently, an attacker can use ../ sequences to escape the configured upload directory, leading to arbitrary file read, write, and deletion on the host filesystem. This occurs because the backend performs direct string concatenation of the base upload path and the user-provided path variable. The issue affects the following functions: copyIn(), streamOut(), and remove().

Recommendations Update uploadfs to version 1.28.0.