HighVulnerability
GHSA-62gx-5q78-wrvx: obsidian-local-rest-api: Authenticated path traversal via URL-encoded %2F in /vault/{path} — arbitrary host file read/write/delete
- Identifier
- GHSA-62gx-5q78-wrvx
- Published
- Record updated
- Affected
- obsidian-local-rest-api < 4.1.3
- Fixed in
- No fixed version was stated when the source was last read.
Summary
The obsidian-local-rest-api plugin's /vault/{path} endpoints (GET, PUT, PATCH, POST, DELETE) decode the request path with decodeURIComponent after Express routing, with no confinement check. An authenticated client can send ..%2F..%2F sequences to escape the vault and read, write, or delete arbitrary files with the Obsidian process's privileges. The advisory notes that MCP and LLM-agent deployments make this easier to reach through prompt injection in vault content.
Mitigation
The source recommends applying the same posix.resolve(syntheticRoot, ...) and startsWith confinement check that vaultMove already uses to the decoded path in every vault handler, and rejecting any segment that decodes to '..'.
Related items
- MediumWhen LLM Gateways Go Wrong: Findings from LiteLLMSimilar attack · Check Point Research
- HighCVE-2026-109403: conductor-oss conductor server-side request forgery in agent card fetchingSimilar attack · NVD/CVE Database
- InfoExploring Backdoor Vulnerabilities and Fairness Challenges in Generative Models: A SurveySimilar attack · ACM Digital Library (TOPS, DTRAP, CSUR)
- LowSmall AI Models Could Soon Self-Replicate on IoT Devices, Anthropic WarnsSimilar attack · SecurityWeek
- MediumCVE-2026-108940: Mistral.rs path traversal through calibration_apply save_cimatrix argumentSimilar attack · NVD/CVE Database