Executive Summary

This vulnerability is a Directory Traversal attack in the Mastra Typescript framework (versions 0.13.8 through 0.13.20-alpha.0). Although there is a security check intended to prevent path traversal when reading file contents, this check is bypassed by later code that tries to find directory suggestions. As a result, an attacker can list the contents of arbitrary directories on the user's filesystem, including sensitive directories like the user's home directory, exposing information about the file system's structure.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker with limited privileges to disclose directory listings on the affected system. By accessing arbitrary directories, including the user's home directory, sensitive information about the file system structure and potentially sensitive files can be exposed. This can lead to information disclosure that may aid further attacks or compromise user privacy.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Mastra to version 0.13.20 or later, as this version contains the fix for the directory traversal vulnerability.

Useful 0 Not Useful 0