The Agent Skills Directory

[DATA_EXFILTRATION]: Path traversal vulnerability in the download handler example. The code extracts a filename parameter directly from the request (req.param("filename")) and uses it to construct a file path (files/{filename}) without sanitization. An attacker could use sequences like ../../etc/passwd to read sensitive files outside the intended directory.
[COMMAND_EXECUTION]: Multiple Path Traversal vulnerabilities in file upload examples. In the upload, upload_files, and OpenAPI upload handlers, the code uses file.name() (a user-provided value from the Content-Disposition header) to construct the destination path in temp/ or uploads/ directories. Without sanitization, an attacker could provide a malicious filename to overwrite system binaries or configuration files, potentially leading to remote code execution or system compromise.
[COMMAND_EXECUTION]: Path traversal vulnerability in the raw_upload handler. The code uses a filename directly from a query parameter (req.query("filename")) to create a file on the filesystem. This allows an attacker to specify arbitrary write locations by providing a path like ?filename=../../root/.ssh/authorized_keys.

salvo-file-handling