CVE-2026-27897
Directory Traversal in Vociferous API Allows Arbitrary File Write
Publication date: 2026-03-11
Last updated on: 2026-03-20
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wanderingastronomer | vociferous | to 4.4.2 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-306 | The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. |
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': 'CVE-2026-27897 is a critical unauthenticated remote path traversal vulnerability in the Vociferous application versions prior to 4.4.2. The flaw exists in the export_file route where the application accepts a JSON payload containing a filename and content. The API does not validate the filename string before processing it with backend filesystem logic.'}, {'type': 'paragraph', 'content': 'Because the API is unauthenticated and has an overly permissive CORS configuration, an attacker can bypass the intended native UI dialog and supply directory traversal sequences (e.g., "../") in the filename. This allows the attacker to write arbitrary data to any location accessible by the current user\'s permissions on the host system.'}, {'type': 'paragraph', 'content': 'This vulnerability can be exploited remotely without any user interaction or privileges, potentially leading to remote code execution and full system compromise.'}] [1]
How can this vulnerability impact me? :
This vulnerability can have severe impacts including unauthorized writing of arbitrary files anywhere the current user has access. An attacker can overwrite critical files such as authorized_keys, drop malware, or delete important files.
On shared servers, this can lead to cross-user impact and full system compromise, allowing attackers to execute remote code and gain control over the affected system.
The vulnerability requires no privileges and no user interaction, making it highly exploitable and dangerous.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by monitoring for unauthorized POST requests to the export_file API endpoint, specifically to the URL path /api/export on the Vociferous service (default port 18900). Look for JSON payloads containing filenames with directory traversal sequences such as "../".'}, {'type': 'paragraph', 'content': 'A practical detection method is to capture and inspect HTTP traffic to identify suspicious requests that attempt to write files outside the intended directory.'}, {'type': 'paragraph', 'content': 'Example command using curl to test if the vulnerable endpoint is accessible and accepts directory traversal in the filename:'}, {'type': 'list_item', 'content': 'curl -X POST http://localhost:18900/api/export -H "Content-Type: application/json" -d \'{"filename": "../test.txt", "content": "test"}\''}, {'type': 'paragraph', 'content': 'Additionally, network monitoring tools or intrusion detection systems (IDS) can be configured to alert on POST requests with suspicious JSON payloads containing directory traversal patterns targeting the /api/export route.'}] [1]
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': 'Immediate mitigation steps include:'}, {'type': 'list_item', 'content': 'Upgrade Vociferous to version 4.4.2 or later, where this vulnerability is fixed.'}, {'type': 'list_item', 'content': 'Implement input sanitization by ensuring the filename parameter is sanitized, for example by using os.path.basename() to strip directory traversal sequences.'}, {'type': 'list_item', 'content': 'Enforce mandatory API authentication such as Bearer Tokens or API Keys to prevent unauthorized access and Cross-Site Request Forgery (CSRF).'}, {'type': 'list_item', 'content': 'Restrict CORS policy to allow only trusted origins instead of using wildcards like "*" or allowing localhost.'}, {'type': 'list_item', 'content': 'Implement path anchoring and validation by resolving absolute paths and ensuring file writes occur only within a designated export directory.'}] [1]