A path traversal vulnerability in Volcengine OpenViking allows unauthenticated attackers to write arbitrary files to the system, posing a significant risk of system compromise.

This is a path traversal vulnerability (CWE-22) residing in the .ovpack import function. An unauthenticated attacker can craft a malicious ZIP archive containing traversal sequences, which causes the application to write files to unauthorized locations on the host filesystem with the privileges of the importing process.

The ability to write arbitrary files to the filesystem can lead to full system compromise, as attackers may overwrite sensitive configuration files or place malicious executables to achieve remote code execution. With a CVSS score of 7.8, this vulnerability represents a high risk to organizational security, potentially resulting in complete data loss or unauthorized administrative access to the underlying infrastructure.

Immediate Action: Update your OpenViking installation to the version reflecting the fix in commit 46b3e76e28b9b3eee73693720c9ec48820228b72.

Proactive Monitoring: Review system logs for unusual file creation events or unexpected modifications to configuration directories associated with the OpenViking import process.

Compensating Controls: Ensure that the service running the OpenViking import process operates with the principle of least privilege, specifically restricting write access to only the necessary directories to limit the scope of a potential traversal attack.

Public Exploit Available: Unknown.

Given the potential for arbitrary file writes and the existence of a proof-of-concept, users must prioritize upgrading their OpenViking environment to the patched version. Organizations that cannot immediately apply the patch should restrict the ability to import untrusted .ovpack files to prevent potential exploitation of this critical flaw.