Description
Owncast is an open source, self-hosted, decentralized, single user live video streaming and chat server. The Owncast application exposes an administrator API at the URL /api/admin. The emoji/delete endpoint of said API allows administrators to delete custom emojis, which are saved on disk. The parameter name is taken from the JSON request and directly appended to the filepath that points to the emoji to delete. By using path traversal sequences (../), attackers with administrative privileges can exploit this endpoint to delete arbitrary files on the system, outside of the emoji directory. This vulnerability is fixed in 0.1.3.
References (4)
Core 4
Core References
Exploit, Third Party Advisory x_refsource_confirm
https://securitylab.github.com/advisories/GHSL-2023-277_Owncast/
Patch x_refsource_misc
https://github.com/owncast/owncast/commit/1b14800c7d7f54be14ed4d130bfe7f480645076e
Product x_refsource_misc
https://github.com/owncast/owncast/blob/v0.1.2/controllers/admin/emoji.go#L63
Release Notes x_refsource_misc
https://github.com/owncast/owncast/releases/tag/v0.1.3
Scores
CVSS v3
2.7
EPSS
0.0013
EPSS Percentile
31.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
partial
Details
CWE
CWE-22
Status
published
Products (2)
owncast/owncast
0 - 0.1.3Go
owncast_project/owncast
< 0.1.3
Published
Apr 19, 2024
Tracked Since
Feb 18, 2026