Vulnerability feed

Executive summary

A flaw was found in the EventCatalog SDK, versions up to 2.29.0. The advisory describes a path containment issue that let custom doc reads, writes, and deletes reach files outside the catalog docs directory. The advisory text does not state a severity rating, and it shows a code change that fixes the issue.

Technical summary

The advisory describes a path traversal weakness in the custom doc functions of the EventCatalog SDK, where custom doc file paths were not confined to the catalog docs directory. The fix adds path validation that rejects null bytes, drive-letter and UNC paths, and paths that resolve outside the docs root, and it resolves symlinks so that links pointing outside the docs directory are not followed. The attack vector and required privileges are not stated, and the advisory does not state a CVSS score or whether exploitation occurred in the wild. The advisory text shows a fixed change set in a patch release but does not explicitly name the fixed version number, and it does not state any workaround. Detection guidance is not stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from github.com/event-catalog/eventcatalog/c…92e88d8b4893f4c6d6ca

Impact if exploited

How it is exploited

Attack vector

Local

Attack complexity

Low

Attack requirements

None

Privileges required

Low

User interaction

None

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affects

eventcatalogeventcatalog sdk