CyberRota Analysis
AI-GeneratedUber Kraken versions up to 0.1.29 are vulnerable due to inadequate validation of the tag parameter in the /tags/{tag} endpoint, enabling unauthenticated attackers to exploit directory traversal vulnerabilities. This flaw allows attackers to access arbitrary files outside the designated storage root, posing a significant risk of data exposure. Organizations using affected versions should prioritize remediation to mitigate potential unauthorized access to sensitive information.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Uber Kraken through 0.1.29 fails to validate the tag parameter in the /tags/{tag} endpoint, allowing unauthenticated attackers to traverse outside the configured storage root. Attackers can use percent-encoded parent-directory segments in the tag parameter to read arbitrary files accessible to the testfs backend process.