CVE-2022-39215: high-severity vulnerability in tauri-apps tauri
The readDir Endpoint Scope can be Bypassed With Symbolic Links in Tauri
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.3epss 1.0%
Tauri is a framework for building binaries for all major desktop platforms. Due to missing canonicalization when `readDir` is called recursively, it was possible to display directory listings outside of the defined `fs` scope. This required a crafted symbolic link or junction folder inside an allowed path of the `fs` scope. No arbitrary file content could be leaked. The issue has been resolved in version 1.0.6 and the implementation now properly checks if the requested (sub) directory is a symbolic link outside of the defined `scope`. Users are advised to upgrade. Users unable to upgrade should disable the `readDir` endpoint in the `allowlist` inside the `tauri.conf.json`.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
Affected products
tauri-apps · tauriRelated CVEs — tauri-apps tauri
In the same product, most dangerous first.
CVE-2022-46171MEDIUMTauri vulnerable to path traversalEPSS 1.1%CVE-2023-34460MEDIUMTauri vulnerable to Regression on Filesystem Scope Checks for DotfilesEPSS 0.6%CVE-2023-31134MEDIUMTauri Open Redirect Vulnerability Possibly Exposes IPC to External SitesEPSS 0.5%CVE-2022-41874LOWTauri Filesystem Scope can be Partially BypassedEPSS 0.5%CVE-2024-35222MEDIUMiFrames Bypass Origin Checks for Tauri API Access ControlEPSS 0.3%CVE-2026-42184MEDIUMTauri: Origin Confusion Allows Remote Pages to Invoke Local-Only IPC CommandsEPSS 0.3%