CVE-2023-46496

Root

Cause

EverShop NPM versions prior to v.1.0.0-rc.8 contain a directory traversal vulnerability (CWE-23) in the file deletion endpoint. The function unlinkSync in deleteFile.js fails to properly validate user-supplied path components, allowing .. sequences to escape the intended upload directory [3].

Attack

Vector

A remote attacker can send a crafted DELETE request to the /api/files endpoint without requiring authentication. By manipulating the filename parameter to include relative path traversals (e.g., ../../../etc/passwd), the attacker can reference files outside the restricted storage folder [1][3].

Impact

Successful exploitation enables arbitrary file deletion on the server's filesystem. This goes beyond simple information disclosure because the unlinkSync call removes the target file, potentially disrupting the application, deleting configuration files, or causing data loss [3]. The official CVE description notes that sensitive information may also be obtained, though the primary consequence is file removal [1].

Mitigation

The vulnerability has been patched in EverShop v.1.0.0-rc.8. The fix was introduced via pull request #338, which added input sanitization to prevent path traversal attacks [4]. Users should upgrade to the latest version immediately.