saltcorn vulnerabilities
4 published CVEs name saltcorn among the affected products.
- 4Published CVEs4 of them scored
- 3Last 12 monthspublished in the last year
- 1Critical1 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-42259
Saltcorn: Open Redirect in `POST /auth/login` due to incomplete `is_relative_url` validation (backslash bypass)
saltcorn · saltcorn
Medium5.1 - CVE-2026-41478
Saltcorn: SQL Injection via Unparameterized Sync Endpoints (maxLoadedId)
saltcorn · saltcorn
Critical10.0 - CVE-2026-40163
Saltcorn has an Unauthenticated Path Traversal in sync endpoints allows arbitrary file write and directory read
saltcorn · saltcorn
High8.2 - CVE-2024-47818
Logged-in users with any role can delete arbitrary files in @saltcorn/server
saltcorn · saltcorn
Medium6.5