Edit ndaal-sa-2026-047

Document Metadata

Tracking ID *

Title *

Category *

Status *

Document Version *

TLP 2.0 *

Verschlusssache

NATO

Initial Release Date *

Current Release Date *

Summary *

ndaal_public_csaf_crud (the `csaf-crud` web application and the `csaf-core` library it embeds) is affected by a path-traversal vulnerability (CWE-22) in the CSAF export path. The exported file location is derived from the imported document's `document.tracking.id` field, which is fully attacker-controllable: a CSAF document accepted on import carries a tracking ID that the exporter splits into a `{year}/{sequence}` directory pair and joins directly onto the configured export directory. Document validation only checks that the tracking ID is non-empty, and the `parse_tracking_id` helper only checks that the year is four numeric digits and that the sequence contains no extra `-` separator. It does NOT reject path separators or `..` segments in the sequence. A crafted tracking ID such as `ndaal-sa-2026-../../escaped` therefore survives both checks and resolves to a directory OUTSIDE the export root, allowing an operator who imports an attacker-supplied advisory and then exports it to write CSAF JSON (and its hash sidecars) to an arbitrary filesystem location reachable by the service account. Fixed in 0.3.3 by routing every externally-derived path through a new `csaf_core::path_security::safe_join` capability-style guard that rejects `..`, absolute paths, drive/UNC prefixes, and NUL bytes before any filesystem operation runs.

Publisher

Name *

Namespace *

Category *

Contact details

Affected Product

Vendor *

Product Name *

Product ID *

Product Status *

Vulnerability

Required for Security Advisories, optional for Informational / VEX.

CVE ID

Vulnerability Title

Vulnerability Description

CWE ID

CWE Name

CVSS v3.1

Base Score (0.0 – 10.0)

Severity

CVSS v3.1 Vector

CVSS v4.0

Base Score (0.0 – 10.0)

Severity

CVSS v4.0 Vector

Cancel