CVE Details
Basic Information
| Title | Steel Browser files.routes.ts handleFileUpload path traversal |
|---|---|
| Type | cve |
| Published | 2025-06-17T01:31:05.835Z |
| Last Seen |
Product Information
| Vendor | Steel |
|---|---|
| Product | Browser |
| Version | 0.1.0 |
CVSS Information
| Base Score | 5.3 (MEDIUM) |
|---|---|
| Attack Vector | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X |
| Confidentiality Impact | |
| Integrity Impact | |
| Availability Impact |
AI Analysis
| AI Description | A critical path traversal vulnerability exists in Steel Browser versions up to 0.1.3, allowing remote attackers to manipulate file paths and potentially access or modify sensitive files. The issue is fixed in patch 7ba93a10000fb77ee01731478ef40551a27bd5b9. |
|---|---|
| AI Severity | Critical |
| Vendor | Steel |
| Product | Steel Browser |
| Affected Version | 0.1.0, 0.1.1, 0.1.2, 0.1.3 |
Affected Products
- Steel Browser 0.1.0
- Steel Browser 0.1.1
- Steel Browser 0.1.2
- Steel Browser 0.1.3
Additional Information
| CVE List | |
|---|---|
| CWE List | CWE-22 |
| Bulletin Family |
References
- https://vuldb.com/?id.312627
- https://vuldb.com/?ctiid.312627
- https://vuldb.com/?submit.593060
- https://github.com/steel-dev/steel-browser/issues/129
- https://github.com/steel-dev/steel-browser/issues/129#issuecomment-2936052240
- https://github.com/steel-dev/steel-browser/commit/7ba93a10000fb77ee01731478ef40551a27bd5b9
Description
A vulnerability, which was classified as critical, was found in Steel Browser up to 0.1.3. This affects the function handleFileUpload of the file api/src/modules/files/files.routes.ts. The manipulation of the argument filename leads to path traversal. It is possible to initiate the attack remotely. The patch is named 7ba93a10000fb77ee01731478ef40551a27bd5b9. It is recommended to apply a patch to fix this issue.