Security vulnerabilities

Attached to Project: Security vulnerabilities
Opened by subhash - 16.08.2026
Last edited by cbay - 19.08.2026

## Description
The Alwaysdata Service feature does not properly restrict the Working Directory to the user's authorized directory. By using directory traversal (`../`) in the Working Directory, an authenticated user can escape the intended directory boundary. The configured service command is then executed from the resulting directory, and its output is returned in the service logs.

The demonstrated impact is unauthorized directory and filename enumeration outside the intended Working Directory.

## CVSS → CVSS v3.1: 5.3 (Medium) → CWE-22 — Path Traversal

## Steps to Reproduce
1. Log in to an Alwaysdata account.
2. Go to Services and create a new service.
3. Set the command to:

ls

4. Set the Working Directory to a traversal path that escapes the authorized directory.

../../
../victim/www
../../root/

5. Start the service.
6. Open the service Logs.
7. Observe that the command executes outside the intended Working Directory and returns directory names that are outside the user's authorized path.

For example, the service logs returned root-level directories including:

alwaysdata
bin
boot
dev
etc
home
lib
lib32
lib64
media
mnt
nfs
opt
proc
root
run
sbin
srv
sys
tmp
usr
var

## Impact
An authenticated user can bypass the intended Working Directory restriction and:

* Enumerate directories outside the authorized path.
* Obtain filenames and directory names.
* Determine whether specific filesystem paths exist.
* Disclose filesystem structure through service logs.

The demonstrated PoC is limited to directory and filename enumeration. No file contents were accessed or modified.

## Actual Behavior
The Service feature accepts a traversal-based Working Directory and executes the configured command outside the intended directory boundary. The resulting directory contents are disclosed through the service logs.

## Expected Behavior
The Working Directory should remain restricted to the directories authorized for the service. Traversal sequences such as ../ should not allow the resolved path to escape that boundary.

## Proof Of Concept
Drive_Link → https://drive.google.com/file/d/117lXZYv3Y6KHEjs8qEGSIP4gGsPzrE8v/view?usp=sharing

## Summary
An authenticated Alwaysdata user can use path traversal in the Service Working Directory field to escape the intended directory restriction, causing service commands such as ls to execute from unauthorized filesystem locations and disclose directory/file names through service logs.

Thanks