Medium severity6.5OSV Advisory· Published Feb 6, 2018· Updated Jun 17, 2026
CVE-2017-6200
CVE-2017-6200
Description
Sandstorm before build 0.203 allows remote attackers to read any specified file under /etc or /run via the sandbox backup function. The root cause is that the findFilesToZip function doesn't filter Line Feed (\n) characters in a directory name.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2v0.101, v0.102, v0.103, …+ 1 more
- (no CPE)range: v0.101, v0.102, v0.103, …
- (no CPE)range: <0.203
Patches
Vulnerability mechanics
References
5- github.com/sandstorm-io/sandstorm/commit/4ea8df7403381d9b657b121b3c98d8081b27414dnvdPatchThird Party Advisory
- github.com/sandstorm-io/sandstorm/commit/6e8572ea8bb56d0216bb1b410e5040edc051b120nvdPatchThird Party Advisory
- devco.re/blog/2018/01/26/Sandstorm-Security-Review-CVE-2017-6200-en/nvdExploitThird Party Advisory
- github.com/sandstorm-io/sandstorm/blob/v0.202/src/sandstorm/backup.c%2B%2BnvdThird Party Advisory
- sandstorm.io/news/2017-03-02-security-reviewnvdVendor Advisory
News mentions
0No linked articles in our index yet.