GHSA-fv2p-qj5p-wqq4: 
vulnerability analysis and mitigation

A path traversal vulnerability was discovered in LF Edge eKuiper affecting versions <= 1.14.7 and < 2.2.0. The vulnerability, identified as GHSA-fv2p-qj5p-wqq4, allows attackers to write arbitrary files to the system and replace files owned by the kuiper user on the filesystem. The issue was discovered by Alexey Kosmachev, Lead Pentester from Bi.Zone, and was published on July 3, 2025 (GitHub Advisory).

The vulnerability exists in the fileUploadHandler function where the application trusts the filename provided by the user without proper validation. This includes cases when the user provides a path instead of just a filename. The vulnerability has been assigned a CVSS score of 8.5 (High), with the following metrics: Attack Vector: Network, Attack Complexity: Low, Privileges Required: Low, User Interaction: None, Scope: Changed, Confidentiality: None, Integrity: High, and Availability: Low. The vulnerability is classified as CWE-24 (GitHub Advisory).

The vulnerability has two main impacts: it enables attackers to upload files to external directories outside the intended upload directory, and it allows the modification of any file owned by the kuiper user on the filesystem, including the main kuiper binaries. This could potentially lead to full control of the server through modification of application data or behavior (GitHub Advisory).

The vulnerability has been patched in version 2.2.0 of eKuiper. Users are advised to upgrade to this version to protect against potential exploitation (GitHub Advisory).