{"id":"PYSEC-2026-1194","summary":"Assemblyline 4 service client vulnerable to Arbitrary Write through path traversal in Client code ","details":"**Path-Traversal -\u003e Arbitrary File Write in Assemblyline Service Client**\n\n**IMPORTANT**: This vulnerability is valid if you decide to use the assemblyline-service-client outside of the normal practice to using Assemblyline in a production environment. In practice, this code should always be executed within a containerized environment such as [assemblyline-v4-service](https://github.com/CybercentreCanada/assemblyline-v4-service) which ensures filesystem-level permissions of what the running user is allowed to access. Furthermore, there is fewer chances for a MiTM compromise when deployed properly in a Docker or Kubernetes deployment where the platform will assign the correct network policies to secure connections between containers instead of relying on the user to set this up manually.\n\nSee https://github.com/CybercentreCanada/assemblyline/issues/382 for further discussion.\n\n---\n\n## 1. Summary  \nThe Assemblyline 4 **service client** (`task_handler.py`) accepts a SHA-256 value returned by the service **server** and uses it directly as a local file name.  \n\u003e No validation / sanitisation is performed.\n\nA **malicious or compromised server** (or any MITM that can speak to client) can return a path-traversal payload such as  \n`../../../etc/cron.d/evil`  \nand force the client to write the downloaded bytes to an arbitrary location on disk.\n\n---\n\n## 2. Affected Versions  \n| Item | Value |\n|---|---|\n| **Component** | `assemblyline-service-client` |\n| **Repository** | [CybercentreCanada/assemblyline-service-client](https://github.com/CybercentreCanada/assemblyline-service-client) |\n| **Affected** | **All releases up to master branch.**  |\n\n\n---\n\n## 3. CVSS 3.1 Vector & Score  \n```\nCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L\n```\n\n\n---\n\n## 4. Technical Details\n\n| Field | Content |\n|---|---|\n| **Location** | `assemblyline_service_client/task_handler.py`, inside `download_file()` |\n| **Vulnerable Line** | `file_path = os.path.join(self.tasking_dir, sha256)` |\n| **Root Cause** | The `sha256` string is taken directly from the service-server JSON response and used as a file name without any validation or sanitisation. |\n| **Exploit Flow** | 1. Attacker (service server) returns HTTP 200 for `GET /api/v1/file/../../../etc/cron.d/evil`.\u003cbr\u003e2. Client writes the response body to `/etc/cron.d/evil`.\u003cbr\u003e3. Achieves arbitrary file write (code execution if file is executable). |\n\n---\n\n## 5. Impact  \n- **Integrity** – Overwrite any file writable by the service UID (often root).  \n- **Availability** – Corrupt critical files or exhaust disk space.  \n- **Code Execution** – Drop cron jobs, systemd units, or overwrite binaries.\n\n---\n\n## 6. Mitigation / Fix\n\n```python\nimport re\n\n_SHA256_RE = re.compile(r'^[0-9a-fA-F]{64}\\Z')\n\ndef download_file(self, sha256: str, sid: str) -\u003e Optional[str]:\n    if not _SHA256_RE.fullmatch(sha256):\n        self.log.error(f\"[{sid}] Invalid SHA256: {sha256}\")\n        self.status = STATUSES.ERROR_FOUND\n        return None\n    # or your preferred way to check if a string is a shasum.\n```\n---","aliases":["CVE-2025-55013","GHSA-75jv-vfxf-3865"],"modified":"2026-07-07T17:47:11.629554721Z","published":"2026-07-07T16:02:58.794662Z","references":[{"type":"WEB","url":"https://github.com/CybercentreCanada/assemblyline/security/advisories/GHSA-75jv-vfxf-3865"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55013"},{"type":"WEB","url":"https://github.com/CybercentreCanada/assemblyline-service-client/commit/351414e7e96cc1f5640ae71ae51b939e8ba30900"},{"type":"PACKAGE","url":"https://github.com/CybercentreCanada/assemblyline-service-client"},{"type":"PACKAGE","url":"https://pypi.org/project/assemblyline-service-client"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-75jv-vfxf-3865"}],"affected":[{"package":{"name":"assemblyline-service-client","ecosystem":"PyPI","purl":"pkg:pypi/assemblyline-service-client"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.0.stable11"},{"introduced":"4.6.1.dev0"},{"fixed":"4.6.1.dev138"}]}],"versions":["4.6.1.dev0","4.6.1.dev1","4.6.1.dev10","4.6.1.dev100","4.6.1.dev101","4.6.1.dev102","4.6.1.dev105","4.6.1.dev106","4.6.1.dev107","4.6.1.dev108","4.6.1.dev109","4.6.1.dev110","4.6.1.dev111","4.6.1.dev112","4.6.1.dev113","4.6.1.dev114","4.6.1.dev115","4.6.1.dev116","4.6.1.dev117","4.6.1.dev119","4.6.1.dev120","4.6.1.dev121","4.6.1.dev122","4.6.1.dev123","4.6.1.dev124","4.6.1.dev125","4.6.1.dev126","4.6.1.dev128","4.6.1.dev129","4.6.1.dev13","4.6.1.dev130","4.6.1.dev131","4.6.1.dev132","4.6.1.dev133","4.6.1.dev134","4.6.1.dev135","4.6.1.dev136","4.6.1.dev137","4.6.1.dev15","4.6.1.dev16","4.6.1.dev18","4.6.1.dev2","4.6.1.dev20","4.6.1.dev21","4.6.1.dev22","4.6.1.dev23","4.6.1.dev24","4.6.1.dev25","4.6.1.dev26","4.6.1.dev27","4.6.1.dev28","4.6.1.dev31","4.6.1.dev32","4.6.1.dev33","4.6.1.dev34","4.6.1.dev35","4.6.1.dev36","4.6.1.dev37","4.6.1.dev38","4.6.1.dev39","4.6.1.dev4","4.6.1.dev40","4.6.1.dev41","4.6.1.dev42","4.6.1.dev43","4.6.1.dev44","4.6.1.dev48","4.6.1.dev49","4.6.1.dev5","4.6.1.dev50","4.6.1.dev51","4.6.1.dev52","4.6.1.dev53","4.6.1.dev54","4.6.1.dev55","4.6.1.dev56","4.6.1.dev57","4.6.1.dev58","4.6.1.dev59","4.6.1.dev60","4.6.1.dev62","4.6.1.dev63","4.6.1.dev64","4.6.1.dev65","4.6.1.dev66","4.6.1.dev67","4.6.1.dev68","4.6.1.dev69","4.6.1.dev7","4.6.1.dev72","4.6.1.dev73","4.6.1.dev74","4.6.1.dev75","4.6.1.dev76","4.6.1.dev77","4.6.1.dev78","4.6.1.dev79","4.6.1.dev80","4.6.1.dev81","4.6.1.dev82","4.6.1.dev84","4.6.1.dev85","4.6.1.dev86","4.6.1.dev87","4.6.1.dev88","4.6.1.dev89","4.6.1.dev9","4.6.1.dev90","4.6.1.dev92","4.6.1.dev93","4.6.1.dev94","4.6.1.dev95","4.6.1.dev97","4.6.1.dev98","4.6.1.dev99"],"database_specific":{"source":"https://github.com/pypa/advisory-database/blob/main/vulns/assemblyline-service-client/PYSEC-2026-1194.yaml"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L"}]}