{"action":"Upgrade @saltcorn/server to 1.0.0-beta.16 or later.","affected":[{"fixed":"1.0.0-beta.16","introduced":"0"}],"component":"@saltcorn/server","cve_ids":["CVE-2024-47818"],"ecosystem":"npm","epss":0.00783,"exploited":false,"fixed_versions":["1.0.0-beta.16"],"ghsa_id":"GHSA-43f3-h63w-p6f6","id":"tcs_01M5KEYZ0W2HMQ8N3RCW3GDNNG","modified_at":"2024-10-08T14:19:02Z","published_at":"2024-10-07T15:10:52Z","references":["https://osv.dev/vulnerability/GHSA-43f3-h63w-p6f6","https://github.com/saltcorn/saltcorn/security/advisories/GHSA-43f3-h63w-p6f6","https://nvd.nist.gov/vuln/detail/CVE-2024-47818","https://github.com/saltcorn/saltcorn/commit/3c551261d0e230635774798009951fa83a07cc3a","https://github.com/saltcorn/saltcorn","https://github.com/saltcorn/saltcorn/blob/v1.0.0-beta.15/packages/server/routes/sync.js#L337-L346"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-43f3-h63w-p6f6","url":"https://osv.dev/vulnerability/GHSA-43f3-h63w-p6f6"}],"summary":"Saltcorn Server allows logged-in users to delete arbitrary files because of a path traversal vulnerability"}