CyberRota Analysis
AI-GeneratedThe vulnerability affects libks, a foundational component for SignalWire C products, where the `clean_uri()` function in the HTTP request parser fails to properly handle URIs with excessive path segments. This oversight can lead to path traversal attacks, allowing unauthorized access to filesystem paths by exploiting embedded ".." sequences. Organizations utilizing versions prior to 2.0.11 should prioritize patching to mitigate the risk of potential data exposure and system compromise.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
libks provides foundational support for signalwire C products. Prior to version 2.0.11, `clean_uri()` in libks's HTTP request parser fails to reject URIs whose path has more segments than its internal canonicalization buffer can hold. The canonicalization step silently passes such URIs through with embedded ".." sequences intact, enabling path traversal in any consumer that later joins the URI with a filesystem path. Version 2.0.11 patches the issue.