Path Traversal in openCode Worktree.remove Component

Executive Summary

Missing path validation in the Worktree.remove component of openCode v1.18.26 allows attackers to execute arbitrary recursive directory deletion via a crafted payload. The DELETE /experimental/worktree endpoint fails to validate caller-supplied directory paths, leading to unintended recursive deletion of any writable directory on the filesystem.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your openCode instance is running version 1.18.26 or earlier. Inspect server logs for suspicious DELETE requests to /experimental/worktree with non-registered directory paths. Monitor for unexpected directory deletions or recursive file removal operations.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows any authenticated API caller to delete any writable directory on the filesystem, including unrelated repositories, home directories, and critical files like SSH keys. This can result in complete data loss and system compromise.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized directory deletion, potentially causing loss of sensitive data such as user files, configuration files, or repositories. For GDPR, this may result in unauthorized data erasure or processing violations. For HIPAA, it could compromise protected health information if deleted or exposed during the attack.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade openCode to a patched version beyond 1.18.26. If upgrading is not possible, restrict access to the DELETE /experimental/worktree endpoint by implementing authentication and authorization checks. Disable the experimental worktree feature if unused.

Useful 0 Not Useful 0