CVE-2025-58363: Path Traversal
Summary A path traversal vulnerability in eKuiper's administrative management endpoints allows privileged users or attackers with access to management APIs to delete arbitrary files or directories on the host system.
Details In internal/plugin/native/manager.go, the plugin installation endpoint (POST /plugins/) constructs a temporary directory path by directly joining user-supplied resource names (name) without sufficient sanitization. Supplying path traversal sequences (such as ../../...) causes the deferred cleanup operation (os.RemoveAll) to target arbitrary directories outside the intended plugin directory.
A related issue in configuration and rule lifecycle management where unvalidated rule identifiers could influence file deletion paths was also addressed by introducing unified identifier and file name validation.
PoC 1. Target file deletion via plugin installation endpoint: http POST /plugins/sources HTTP/1.1 Host: 127.0.0.1:9081 Content-Type: application/json
{ "name": "../../../../../tmp/target.txt", "file": "http://example.com/plugin.zip", "shellParas": [], "functions": [] } 2. When the request finishes, /tmp/target.txt is removed by os.RemoveAll.
Impact An attacker with access to eKuiper management APIs can cause arbitrary file or directory deletion, potentially leading to denial of service or disruption of the host environment. This vulnerability provides a delete-only capability and does not permit arbitrary file creation, modification, or code execution.
Remediation & Patches - Upgrade to eKuiper >= 2.4.1: Input validation (validate.ValidateID) and file path validation (path.VerifyFileName) have been enforced across management endpoints.
Workarounds - Restrict network access to eKuiper management port (9081) via authentication, reverse proxies, and firewall rules. - Run eKuiper with a dedicated non-root user account to limit file system deletion permissions.
Credits - @kosmosec - @arpitjain099
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/lf-edge/ekuiper/v2to a version that resolves this vulnerability.Fixed in 2.4.1 - Upgrade
Upgrade
eKuiperto a version that resolves this vulnerability.Fixed in 2.4.1 - Compensating control
Restrict network access to the eKuiper management port (9081) via authentication, reverse proxies, and firewall rules (management endpoints such as 127.0.0.1:9081 should not be reachable by untrusted parties).
- Compensating control
Run eKuiper with a dedicated non-root user account to limit file system deletion permissions.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs privileged access to eKuiper administrative management APIs, including the plugin installation endpoint. The provided data does not establish that unauthenticated or ordinary users can exploit it.
What access and input are required to trigger arbitrary deletion?
The attacker submits a plugin installation request to POST /plugins/* with a resource name containing path-traversal sequences such as ../../. When request cleanup runs, eKuiper can call os.RemoveAll on a path outside the intended plugin directory.
Are rule and configuration management operations also relevant?
Yes. Related configuration and rule lifecycle handling allowed unvalidated rule identifiers to influence file deletion paths; the fix introduced unified validation for identifiers and file names.
What fixed release is referenced?
The supplied references identify eKuiper v2.4.1 as a release associated with this issue. No affected-version range is provided.