From 6ff4d46838f632306ac8078b826f9467d08e540a Mon Sep 17 00:00:00 2001 From: UmmmAGoodName Date: Thu, 5 Mar 2026 16:38:55 +0100 Subject: [PATCH] Fixed the path traversal check --- gns3server/api/routes/index.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/gns3server/api/routes/index.py b/gns3server/api/routes/index.py index 8a12a9ec1..ebd22c096 100644 --- a/gns3server/api/routes/index.py +++ b/gns3server/api/routes/index.py @@ -46,8 +46,8 @@ async def web_ui(file_path: str): file_path = os.path.normpath(file_path).strip("/") file_path = os.path.join("static", "web-ui", file_path) - # Raise error if user try to escape - if file_path[0] == ".": + # Raise error if user tries to escape the web-ui directory + if not os.path.normpath(file_path).startswith(os.path.join("static", "web-ui")): raise HTTPException(status_code=status.HTTP_403_FORBIDDEN) static = get_resource(file_path)