CVE-2026-40163

Saltcorn is an extensible, open source, no-code database application builder. Prior to 1.4.5, 1.5.5, and 1.6.0-beta.4, the POST /sync/offline_changes endpoint allows an unauthenticated attacker to create arbitrary directories and write a changes.json file with attacker-controlled JSON content anywhere on the server filesystem. The GET /sync/upload_finished endpoint allows an unauthenticated attacker to list arbitrary directory contents and read specific JSON files. This vulnerability is fixed in 1.4.5, 1.5.5, and 1.6.0-beta.4.

CVSS v3 8.2 HIGH

8.2^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/saltcorn/saltcorn/security/advisories/GHSA-32pv-mpqg-h292	Exploit Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:saltcorn:saltcorn::::::::
	cpe:2.3:a:saltcorn:saltcorn::::::::
	cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha0::::::
	cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha1::::::
	cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha10::::::
	cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha11::::::
	cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha12::::::
	cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha13::::::
	cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha14::::::
	cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha15::::::
	cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha16::::::
	cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha17::::::
	cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha2::::::
	cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha3::::::
	cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha4::::::
	cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha5::::::
	cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha6::::::
	cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha7::::::
	cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha8::::::
	cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha9::::::
	cpe:2.3:a:saltcorn:saltcorn:1.6.0:beta1::::::
	cpe:2.3:a:saltcorn:saltcorn:1.6.0:beta2::::::
	cpe:2.3:a:saltcorn:saltcorn:1.6.0:beta3::::::

History

27 Apr 2026, 13:36

Type	Values Removed	Values Added
CPE	cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha16::::node.js::* cpe:2.3:a:saltcorn:saltcorn:1.6.0:beta3::::node.js::* cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha5::::node.js::* cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha10::::node.js::* cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha2::::node.js::* cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha3::::node.js::* cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha1::::node.js::* cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha7::::node.js::* cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha11::::node.js::* cpe:2.3:a:saltcorn:saltcorn:1.6.0:beta1::::node.js::* cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha12::::node.js::* cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha8::::node.js::* cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha14::::node.js::* cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha15::::node.js::* cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha9::::node.js::* cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha13::::node.js::* cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha6::::node.js::* cpe:2.3:a:saltcorn:saltcorn::::::node.js::* cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha4::::node.js::* cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha17::::node.js::* cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha0::::node.js::* cpe:2.3:a:saltcorn:saltcorn:1.6.0:beta2::::node.js::*	cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha9:::::: cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha8:::::: cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha14:::::: cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha6:::::: cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha13:::::: cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha10:::::: cpe:2.3:a:saltcorn:saltcorn:1.6.0:beta1:::::: cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha11:::::: cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha3:::::: cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha0:::::: cpe:2.3:a:saltcorn:saltcorn:::::::: cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha16:::::: cpe:2.3:a:saltcorn:saltcorn:1.6.0:beta2:::::: cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha7:::::: cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha2:::::: cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha1:::::: cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha12:::::: cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha5:::::: cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha15:::::: cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha4:::::: cpe:2.3:a:saltcorn:saltcorn:1.6.0:beta3:::::: cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha17::::::

27 Apr 2026, 13:25

Type	Values Removed	Values Added
References	~~() https://github.com/saltcorn/saltcorn/security/advisories/GHSA-32pv-mpqg-h292 -~~	() https://github.com/saltcorn/saltcorn/security/advisories/GHSA-32pv-mpqg-h292 - Exploit, Mitigation, Vendor Advisory
First Time		Saltcorn saltcorn Saltcorn
CPE		cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha14::::node.js::* cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha16::::node.js::* cpe:2.3:a:saltcorn:saltcorn:1.6.0:beta3::::node.js::* cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha5::::node.js::* cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha15::::node.js::* cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha10::::node.js::* cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha9::::node.js::* cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha13::::node.js::* cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha2::::node.js::* cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha6::::node.js::* cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha3::::node.js::* cpe:2.3:a:saltcorn:saltcorn::::::node.js::* cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha1::::node.js::* cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha4::::node.js::* cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha17::::node.js::* cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha7::::node.js::* cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha11::::node.js::* cpe:2.3:a:saltcorn:saltcorn:1.6.0:beta1::::node.js::* cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha0::::node.js::* cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha12::::node.js::* cpe:2.3:a:saltcorn:saltcorn:1.6.0:beta2::::node.js::* cpe:2.3:a:saltcorn:saltcorn:1.6.0:alpha8::::node.js::*

10 Apr 2026, 18:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-04-10 18:16

Updated : 2026-04-27 13:36

NVD link : CVE-2026-40163

Mitre link : CVE-2026-40163

CVE.ORG link : CVE-2026-40163

JSON object : View

Products Affected

saltcorn

saltcorn

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

8.2 /10