An arbitrary file write vulnerability in the NodeBB Plugin Emoji component allows authenticated administrative users to compromise system integrity via directory traversal.

The vulnerability exists in the emoji upload API, where insufficient validation of the file path parameter allows an attacker with administrative privileges to perform directory traversal. By crafting a malicious upload request, an attacker can write files to arbitrary locations on the host filesystem.

The ability to write files to arbitrary system locations poses a critical risk to the confidentiality, integrity, and availability of the host server. An attacker could overwrite configuration files, inject malicious scripts, or modify system files such as SSH authorized keys to achieve persistent unauthorized access. Given the CVSS score of 7.5, this vulnerability represents a significant threat that could lead to a full system compromise.

Immediate Action: Update the NodeBB Plugin Emoji to the latest available version that addresses this vulnerability, or disable the plugin if an immediate update is not feasible.

Proactive Monitoring: Monitor server logs for unusual POST requests directed at the emoji upload API endpoint, specifically looking for path traversal patterns like dot-dot-slash sequences in file name parameters.

Compensating Controls: Implement a Web Application Firewall (WAF) to detect and block malicious upload attempts containing directory traversal sequences, and ensure the service runs with the least privilege necessary to limit the impact of potential file system writes.

Public Exploit Available: Yes, a functional exploit is available via ExploitDB (EDB-ID 49813).

The severity of this flaw, combined with the availability of a public exploit, necessitates immediate action. Administrators should verify their current version of the NodeBB Plugin Emoji and apply the necessary updates to prevent potential system-level compromise. If patching cannot be performed immediately, the plugin should be disabled to remove the attack vector entirely.