GHSA-gmxc-r82q-347r: Path Traversal
Impact options.fileName is used to build a filesystem path (path.join(tempDir.name, fileName)) and the caller-supplied document buffer is written there, but fileName is never reduced to a base name. A fileName containing "../" escapes the temporary directory, so a caller can write arbitrary content to an arbitrary path the process can write to (e.g. ~/.ssh/authorizedkeys, an /etc/cron.d entry, or a web root).
Patches Version 1.8.2 uses path.basename on filename to make sure the temp directory can not be escaped.
Workarounds Make sure you supply the filename yourself and don't have it user supplied or use path.basename on filename before using it in libreoffice-convert.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/libreoffice-convertto a version that resolves this vulnerability.Fixed in 1.8.2 - Upgrade
Upgrade
libreoffice-convertto a version that resolves this vulnerability.Fixed in 1.8.2 - Configuration
Ensure the filename passed to libreoffice-convert is not user-supplied; if you must derive it, reduce it to a basename (e.g., use path.basename) before using it to build the path (options.fileName).
libreoffice-convert options.fileName/fileName handling = Use path.basename(filename) before using it in libreoffice-convert
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using npm/libreoffice-convert are exposed when an attacker can influence the filename passed through options.fileName. The issue can let that caller write content outside the intended temporary directory, subject to the filesystem permissions of the process.
What does an attacker need to exploit it?
The attacker needs the ability to supply or control a filename containing path-traversal sequences such as "../", along with document content to be written. No user interaction is required after the vulnerable application processes those inputs.
What should be done if upgrading is not immediately possible?
Ensure filenames are assigned by the application rather than accepted from users. If user-provided names must be used, apply path.basename to the filename before passing it to libreoffice-convert.
Which version addresses the problem?
Version 1.8.2 uses path.basename on the filename, preventing the temporary-directory escape described in the advisory.