{"id":"GHSA-62gx-5q78-wrvx","kind":"vulnerability","aliases":["GHSA-62gx-5q78-wrvx"],"related":[],"title":"obsidian-local-rest-api: Authenticated path traversal via URL-encoded %2F in /vault/{path} — arbitrary host file read/write/delete","description":"### Summary\nThe Local REST API's `/vault/{path}` endpoints (GET/PUT/PATCH/POST/DELETE) percent-decode the request path *inside the handler — after* Express has already routed and normalized it, then hand it to the Obsidian vault adapter with no confinement check. A literal `../` is resolved/rejected at the routing layer (→ 404), but `%2F` is not a separator there, so `..%2F..%2F` survives routing and is only turned into a real `/` by the handler's `decodeURIComponent`, reconstituting a `../` traversal that walks out of the vault. An **authenticated** client can read, write, or delete **arbitrary files on the host** with the Obsidian process's privileges.\n\n### Details\n**Framework:** Express (`import express from \"express\"`; routes registered via `this.api.route(\"/vault/*\")…`).\n\n**The vulnerable line** — in `src/requestHandler.ts`, every vault handler (`vaultGet`, `vaultPut`, `vaultPatch`, `vaultPost`, `vaultDelete`) derives the path like this:\n  ```ts\n  const rawPath = decodeURIComponent(\n    req.path.slice(req.path.indexOf(\"/\", 1) + 1),\n  );\n  ```\nThe path is `decodeURIComponent`'d **after** Express routing. A literal `../` is collapsed/rejected at the routing layer, but `%2F` isn't a separator there — so `..%2F..%2F` reaches the handler intact and this `decodeURIComponent` turns it into a real `../../`. **The string routing saw (`…%2F…`) is not the string the handler uses (`…/…`)**, and `%2e%2e` behaves the same way.\n\n**No confinement on the decoded path.** The handlers pass `rawPath` straight to the vault adapter — e.g. `this.app.vault.adapter.readBinary(filePath)` / `this.app.vault.getAbstractFileByPath(filePath)` — with no `path.resolve` + vault-root prefix check, so the reconstituted `../../` escapes.\n\n**The fix already exists in your code — for MOVE only.** `vaultMove` confines correctly:\n  ```ts\n  const syntheticRoot = \"/vault\";\n  const resolved = posix.resolve(syntheticRoot, normalized);\n  if (resolved !== syntheticRoot && !resolved.startsWith(syntheticRoot + \"/\")) {\n    this.returnCannedResponse(res, { errorCode: ErrorCode.PathTraversalNotAllowed });\n    return;\n  }\n  ```\nGET/PUT/PATCH/POST/DELETE lack this guard. **Apply the same `posix.resolve(syntheticRoot, …)` + `startsWith` check to the decoded path in every vault handler**, and reject any segment that decodes to `..`.\n\n### PoC\nPrereq: a running Obsidian with the Local REST API plugin enabled and its configured API key (`$API_KEY`). Targets below are Unix; adjust per OS (e.g. `..%2F..%2FWindows%2Fwin.ini` on Windows).\n\n  ```bash\n  # READ outside the vault (returns 200 + the target file's real bytes):\n  curl --path-as-is -k -H \"Authorization: Bearer $API_KEY\" \\\n    \"https://127.0.0.1:27124/vault/..%2F..%2F..%2F..%2Fetc%2Fpasswd\"\n\n  # WRITE outside the vault (creates a file on disk outside the vault root):\n  curl --path-as-is -k -X PUT -H \"Authorization: Bearer $API_KEY\" --data \"pwned\" \\\n    \"https://127.0.0.1:27124/vault/..%2F..%2F..%2Ftmp%2Fcanary.txt\"\n  ```\n\n`--path-as-is` stops curl from collapsing `..` client-side. A plain `../` (unencoded) request returns 404 — only the `%2F`/`%2e%2e` encoded form bypasses, confirming the decode-after-routing gap.\n\n### Impact\nAuthenticated arbitrary file **read / write / delete** outside the Obsidian vault, with the OS privileges of the Obsidian process — typically the user's home directory (SSH keys, browser profiles, dotfiles, credentials). Amplified in MCP/LLM-agent deployments: this API is widely used as an MCP server, so a prompt-injection in vault content (or a malicious MCP client) can make an agent emit a `%2F` path — turning \"the agent can edit my notes\" into \"the agent can read/write any file on the host,\" with no user intent to grant filesystem access beyond the vault.\n\nThis vulnerability was reported by Caleb Brisbin through responsible disclosure.","summary":"The Obsidian Local REST API plugin decodes vault paths after routing, so a %2F sequence becomes a directory traversal that escapes the vault. An authenticated client can read, write or delete any file the Obsidian process can reach on the host.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"obsidian-local-rest-api","fixed":["4.1.3"],"affected":"< 4.1.3","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["claude-code","cwe-22","mcp","obsidian","obsidian-local-rest-api","package","self-hosted"],"not_affected_if":["api-disabled","plugin-not-installed","version-4.1.3-or-later"],"how_to_check":"- Check the installed plugin version in the vault's `.obsidian/plugins/obsidian-local-rest-api/manifest.json` (the `version` field) or with `npm ls obsidian-local-rest-api` if it is used as a package.\n- Confirm whether the REST API is enabled in Obsidian settings under the Local REST API plugin.\n- Check whether an MCP server or agent is configured to call the `/vault/` endpoints.","fix":"- obsidian-local-rest-api: move to `4.1.3` or later","status":"open","published_at":"2026-07-15T21:56:45+00:00","first_seen_at":"2026-11-02T19:28:00+00:00","triaged_at":"2026-11-02T19:28:41+00:00","updated_at":"2026-11-02T19:28:41+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-02T19:28:41Z","model":"claude-haiku-5-5","output":{"fix":"- obsidian-local-rest-api: move to `4.1.3` or later","reach":"network","title":"obsidian-local-rest-api: encoded slashes let an authenticated client reach host files","impact":"high","summary":"The Obsidian Local REST API plugin decodes vault paths after routing, so a %2F sequence becomes a directory traversal that escapes the vault. An authenticated client can read, write or delete any file the Obsidian process can reach on the host.","audience":"developers","category":"package","nicknames":[],"who_cares":["obsidian","obsidian-local-rest-api","mcp","claude-code","self-hosted"],"confidence":0.85,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker reads, writes or deletes arbitrary host files as the user","analyst_note":"","how_to_check":"- Check the installed plugin version in the vault's `.obsidian/plugins/obsidian-local-rest-api/manifest.json` (the `version` field) or with `npm ls obsidian-local-rest-api` if it is used as a package.\n- Confirm whether the REST API is enabled in Obsidian settings under the Local REST API plugin.\n- Check whether an MCP server or agent is configured to call the `/vault/` endpoints.","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","api-disabled","version-4.1.3-or-later"],"who_is_affected":"Exposure requires the Local REST API plugin to be installed and enabled in Obsidian, and an API key holder to send requests. Setups that use the API only locally with no untrusted clients carry less risk, but MCP and agent setups that send vault-derived paths are the most relevant case. Users who do not run the plugin can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000897,"input_tokens":5751,"output_tokens":643,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-22':40B '/..':269C,320C '/vault':15A,99C,204C,338C '1':229C,230C '127.0.0.1':436C,471C '200':418C '27124/vault':437C,472C '2e':283C,284C,497C,498C '2f':13A,65B,142C,149C,150C,248C,255C,256C,274C,407C,438C,439C,440C,473C,474C,496C,572C '2fcanary.txt':476C '2fetc':441C '2fpasswd':442C '2ftmp':475C '2fwin.ini':409C '2fwindows':408C '404':140C,493C '5q78':24A,29A '62gx':23A,28A 'access':598C 'adapt':127C,303C 'adjust':403C 'agent':569C,576C,583C 'alreadi':115C,324C 'amplifi':540C 'api':5A,35A,47B,56B,97C,389C,395C,397C,434C,467C,545C 'appli':358C 'arbitrari':17A,182C,511C 'authent':6A,76B,175C,510C 'author':432C,465C 'bash':412C 'bearer':433C,466C 'becom':67B 'behav':285C 'beyond':599C 'brisbin':608C 'browser':536C 'bypass':501C 'byte':424C 'caleb':607C 'check':131C,316C,364C 'claud':37B 'claude-cod':36B 'client':77B,176C,486C,565C 'client-sid':485C 'code':38B,328C 'collaps':484C 'collapsed/rejected':242C 'configur':394C 'confin':130C,290C,333C 'confirm':502C 'const':224C,336C,339C 'content':560C 'correct':334C 'creat':447C 'credenti':539C 'curl':425C,456C,482C 'cwe':39B 'd':235C 'data':469C 'decod':58B,105C,293C,367C,378C,505C 'decode-after-rout':504C 'decodeuricompon':164C,226C,234C,263C 'delet':82B,181C,515C 'deploy':543C 'deriv':218C 'detail':193C 'directori':69B,533C 'disclosur':611C 'disk':451C 'dotfil':538C 'e.g':304C,406C 'edit':578C 'emit':570C 'enabl':391C 'encod':12A,499C 'endpoint':101C 'errorcod':351C 'errorcode.pathtraversalnotallowed':352C 'escap':72B,321C 'everi':210C,370C 'exist':325C 'express':113C,195C,197C,199C,237C 'file':19A,84B,183C,421C,449C,512C,587C 'filepath':306C,308C 'filesystem':597C 'fix':323C 'form':500C 'framework':194C 'gap':508C 'get/put/patch/post/delete':102C,354C 'ghsa':22A,27A 'ghsa-62gx-5q78-wrvx':21A,26A 'grant':596C 'guard':357C 'h':431C,464C 'hand':121C 'handler':111C,162C,212C,259C,280C,296C,372C 'home':532C 'host':18A,51B,92B,186C,590C 'impact':509C 'import':196C 'inject':557C 'insid':109C 'intact':260C 'intent':594C 'isn':249C 'k':430C,461C 'key':396C,398C,435C,468C,535C 'lack':355C 'layer':139C,246C 'like':221C 'line':207C 'liter':133C,240C 'local':3A,33A,45B,54B,95C,387C 'make':567C 'malici':563C 'mcp':41B,551C,564C 'mcp/llm-agent':542C 'move':330C 'normal':118C,343C 'note':580C 'obsidian':2A,32A,42B,44B,53B,86B,125C,189C,384C,518C,526C 'obsidian-local-rest-api':1A,31A,43B 'os':405C,522C 'outsid':414C,444C,452C,516C 'packag':48B 'pass':297C 'path':7A,16A,60B,100C,108C,220C,232C,294C,368C,427C,458C,478C,573C 'path-as-i':426C,457C,477C 'path.resolve':311C 'per':404C 'percent':104C 'percent-decod':103C 'plain':489C 'plugin':57B,390C 'poc':380C 'posix.resolve':341C,361C 'prefix':315C 'prereq':381C 'privileg':192C,523C 'process':87B,190C,527C 'profil':537C 'prompt':556C 'prompt-inject':555C 'put':463C 'pwned':470C 'rawpath':225C,298C 'reach':89B,257C 'read':79B,178C,413C,513C 'read/write':585C 'read/write/delete':20A 'real':159C,268C,423C 'reconstitut':165C,319C 'regist':201C 'reject':374C 'report':605C 'req.path.indexof':228C 'req.path.slice':227C 'request':107C,491C 'res':350C 'resolv':340C,345C 'resolved.startswith':347C 'resolved/rejected':135C 'respons':610C 'rest':4A,34A,46B,55B,96C,388C 'return':353C,417C,492C 'root':314C,455C 'rout':62B,116C,138C,152C,200C,238C,245C,272C,507C 'run':383C 'saw':273C 'segment':376C 'self':50B 'self-host':49B 'separ':146C,252C 'sequenc':66B 'server':552C 'side':487C 'src/requesthandler.ts':209C 'ssh':534C 'startswith':363C 'stop':481C 'straight':299C 'string':271C,278C 'summari':93C 'surviv':151C 'syntheticroot':337C,342C,346C,348C,362C 'target':399C,420C 'this.api.route':203C 'this.app.vault.adapter.readbinary':305C 'this.app.vault.getabstractfilebypath':307C 'this.returncannedresponse':349C 'travers':8A,70B,167C 'ts':223C,335C 'turn':156C,264C,574C 'typic':528C 'unencod':490C 'unix':402C 'url':11A 'url-encod':10A 'use':281C,548C 'user':530C,593C 'vault':59B,74B,126C,173C,211C,302C,313C,371C,416C,446C,454C,519C,559C,601C 'vault-root':312C 'vaultdelet':217C 'vaultget':213C 'vaultmov':332C 'vaultpatch':215C 'vaultpost':216C 'vaultput':214C 'via':9A,202C 'vulner':206C,603C 'walk':169C 'way':288C 'wide':547C 'window':411C 'write':80B,179C,443C,514C 'wrvx':25A,30A 'x':462C","nicknames":[],"mitigations":[],"who_affected":"Exposure requires the Local REST API plugin to be installed and enabled in Obsidian, and an API key holder to send requests. Setups that use the API only locally with no untrusted clients carry less risk, but MCP and agent setups that send vault-derived paths are the most relevant case. Users who do not run the plugin can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["obsidianlocalrestapi"],"ptokens":["api","local","obsidian","rest"],"labels":["claudecode","cwe22","high","mcp","npm","obsidian","obsidianlocalrestapi","package","selfhosted"],"first_public_at":"2026-06-04T13:27:17+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-62gx-5q78-wrvx","url":"https://github.com/advisories/GHSA-62gx-5q78-wrvx","severity":"high","published_at":"2026-07-15T21:56:45+00:00","modified_at":"2026-11-02T19:26:25+00:00","first_seen_at":"2026-11-02T19:28:00+00:00","fetched_at":"2026-11-02T19:33:04+00:00","note":null}],"documents":[{"id":53551,"url":"https://api.github.com/repos/coddingtonbear/obsidian-local-rest-api/security-advisories/GHSA-62gx-5q78-wrvx","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":53552,"url":"https://github.com/coddingtonbear/obsidian-local-rest-api/security/advisories/GHSA-62gx-5q78-wrvx","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":"2026-06-04T13:27:17+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":53553,"url":"https://github.com/coddingtonbear/obsidian-local-rest-api/releases/tag/4.1.3","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"},{"id":53554,"url":"https://github.com/coddingtonbear/obsidian-local-rest-api/commit/fdc97f9e652e0d38cb43911d31f827a12b248fc8","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}