Symlinks in an ebook library can expose any server file through downloads #27

New issue

Closed

opened 2026-10-18 16:23:37 +00:00 by jfro · 0 comments

jfro commented

2026-10-18 16:23:37 +00:00

Owner

From Nye's review of #17 (F7). Add to #15's symlink item.

The scanner uses Path.wildcard and File.regular?, which follow symlinks. A symlink inside a library pointing at e.g. /etc/passwd becomes an ebook record, and /ebooks/:id/download serves it to any signed-in user.

Fix: File.lstat in the scanner and skip symlinks (or resolve them and require the real path to stay inside the library root); check again at download time. Libraries are admin-configured, which limits this. Related: #15, #14.

From Nye's review of #17 (F7). Add to #15's symlink item. The scanner uses `Path.wildcard` and `File.regular?`, which follow symlinks. A symlink inside a library pointing at e.g. `/etc/passwd` becomes an ebook record, and `/ebooks/:id/download` serves it to any signed-in user. **Fix:** `File.lstat` in the scanner and skip symlinks (or resolve them and require the real path to stay inside the library root); check again at download time. Libraries are admin-configured, which limits this. Related: #15, #14.

jfro added the

security

medium

ebook-branch

labels

2026-10-18 16:23:37 +00:00

jfro referenced this issue from a pull request that will close it,

2026-10-18 17:26:10 +00:00

fix: don't scan or serve ebook symlinks that lead outside the library #40

jfro referenced this issue from a commit

2026-10-18 17:26:10 +00:00

fix: don't scan or serve ebook symlinks that lead outside the library