{"action":"Upgrade @saltcorn/server to 1.0.0-beta.14 or later.","affected":[{"fixed":"1.0.0-beta.14","introduced":"0"}],"component":"@saltcorn/server","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["1.0.0-beta.14"],"ghsa_id":"GHSA-277h-px4m-62q8","id":"tcs_01M5KES8ESC9FMBPMJ29357BM2","modified_at":"2024-10-03T19:46:12Z","published_at":"2024-10-03T19:46:12Z","references":["https://osv.dev/vulnerability/GHSA-277h-px4m-62q8","https://github.com/saltcorn/saltcorn/security/advisories/GHSA-277h-px4m-62q8","https://github.com/saltcorn/saltcorn/commit/024f19a7e079913f62f4a2335ab04116ddb68192","https://github.com/saltcorn/saltcorn","https://github.com/saltcorn/saltcorn/blob/v1.0.0-beta.13/packages/server/routes/admin.js#L671-L682"],"severity":{"label":"medium","score":4.4},"sources":[{"source":"osv","source_id":"GHSA-277h-px4m-62q8","url":"https://osv.dev/vulnerability/GHSA-277h-px4m-62q8"}],"summary":"@saltcorn/server arbitrary file zip read and download when downloading auto backups"}