The flaw is a path‑traversal vulnerability in Saltcorn’s synchronization API. An unauthenticated attacker can send a crafted POST request to the /sync/offline_changes endpoint and create any directory, then write a changes.json file containing attacker‑controlled JSON to an arbitrary location on the server’s filesystem. A separate GET request to /sync/upload_finished allows the attacker to enumerate arbitrary directory contents and read any JSON file. This combination permits unauthorized disclosure of configuration, data, and code, and can lead to overwriting critical files, data loss, or persistence of malicious code.

The issue affects releases of the Saltcorn no‑code database builder before version 1.4.5, 1.5.5, and 1.6.0‑beta.4. The product is distributed by the Saltcorn project under the vendor name saltcorn.

The CVSS score of 8.2 denotes high severity, and the vulnerability is exploitable by any network user without authentication, making the attack vector network‑based. While the EPSS score is reported as less than 1 %, the ease of execution via simple HTTP calls and the lack of authentication requirements means the practical risk is still significant. The vulnerability is not currently listed in CISA’s KEV catalog, but the combination of high severity and unauthenticated access mandates prompt remediation.