GHSA-rj4j-2jph-gg43: Github.com/lf edge/ekuiper/v2 LF Edge EKuiper Is Vulnerable Vulnerability
CRITICALGHSA-rj4j-2jph-gg43 is a CRITICAL lf edge ekuiper is vulnerable vulnerability (CWE-23: Relative Path Traversal) affecting Github.com/lf edge/ekuiper/v2 libraries in the Go ecosystem. The issue involves lf edge ekuiper is vulnerable to arbitrary file read/write via unsanitized names and zip extraction. Remediation is available by upgrading affected packages to version 2.3.0.
GHSA-rj4j-2jph-gg43 at a Glance
How to Fix GHSA-rj4j-2jph-gg43
To remediate this vulnerability, upgrade all affected Github.com/lf edge/ekuiper/v2 dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade github.com/lf-edge/ekuiper/v2 to 2.3.0Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for github.com/lf-edge/ekuiper/v2How to Check if You Are Affected
To determine whether your application is affected by GHSA-rj4j-2jph-gg43, inspect your project dependencies for Github.com/lf edge/ekuiper/v2:
inspect dependencies for github.com/lf-edge/ekuiper/v2Analyze the terminal output to locate any version of Github.com/lf edge/ekuiper/v2 in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 2.3.0), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-23: Relative Path Traversal, where the product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory. In Github.com/lf edge/ekuiper/v2, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
GHSA-rj4j-2jph-gg43 Affected Github.com/lf edge/ekuiper/v2 Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
github.com/lf-edge/ekuiper/v2
|
Go |
< 2.3.0
|
2.3.0
|
References
Frequently Asked Questions
What is GHSA-rj4j-2jph-gg43?
Which Github.com/lf edge/ekuiper/v2 versions are affected?
What version fixes GHSA-rj4j-2jph-gg43?
Is github.com/lf-edge/ekuiper/v2 affected?
What CWE is associated with GHSA-rj4j-2jph-gg43?
How can I check Go dependencies for GHSA-rj4j-2jph-gg43?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-rj4j-2jph-gg43",
"modified" : "2025-11-27T08:40:42Z",
"published" : "2025-11-24T23:31:39Z",
"aliases" : [ ],
"summary" : "LF Edge eKuiper is vulnerable to Arbitrary File Read/Write via unsanitized names and zip extraction",
"details" : "### Summary\nMultiple path traversal and unsafe path handling vulnerabilities were discovered in eKuiper prior to the fixes implemented in PR [lf-edge/ekuiper#3911](https://github.com/lf-edge/ekuiper/pull/3911). The issues allow attacker-controlled input (rule names, schema versions, plugin names, uploaded file names, and ZIP entries) to influence file system paths used by the application. In vulnerable deployments, this can permit files to be created, overwritten, or extracted outside the intended directories, potentially enabling disclosure of sensitive files, tampering with configuration or plugin binaries, denial of service, or other host compromise scenarios.\n\nSeveral components used unvalidated user input when constructing filesystem paths or when extracting archives. In each case, input was accepted and used directly in path operations (join, create, delete, extract) without sufficient sanitization or canonicalization, allowing the input to include path separators, `..` segments, or absolute paths.\n\n### Impact\n**Arbitrary file overwrite / deletion:** attackers could overwrite or delete files outside the intended directory, which can corrupt application data, remove logs, or disable services.\n\n### Resources\n- https://github.com/lf-edge/ekuiper/commit/58362b089c76f08c400fe0dbb3667e6e871eaffd\n- https://github.com/lf-edge/ekuiper/pull/3911",
"severity" : [ {
"type" : "CVSS_V4",
"score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/lf-edge/ekuiper/v2"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "2.3.0"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/lf-edge/ekuiper/security/advisories/GHSA-rj4j-2jph-gg43"
}, {
"type" : "WEB",
"url" : "https://github.com/lf-edge/ekuiper/pull/3911"
}, {
"type" : "WEB",
"url" : "https://github.com/lf-edge/ekuiper/commit/58362b089c76f08c400fe0dbb3667e6e871eaffd"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/lf-edge/ekuiper"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-22", "CWE-23" ],
"severity" : "CRITICAL",
"github_reviewed" : true,
"github_reviewed_at" : "2025-11-24T23:31:39Z",
"nvd_published_at" : null
}
}