AIKIDO-2026-734217
pubnub is vulnerable to Path Traversal
59
Medium Risk
This Affects:
pubnubTL;DR
The file sharing endpoints in pubnub build request paths by interpolating the user provided file id and name values without percent-encoding, while only the channel segment is encoded. Untrusted values containing slashes or dot-dot sequences alter the request path and can escape the files endpoint to reach other server API routes such as access-manager grant. A caller that forwards untrusted file identifiers can manipulate which endpoint the signed request targets. The fix percent-encodes the id and name segments so separators can no longer break out of the intended path.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application passes untrusted input as the file id or name to the file download, file URL, or delete file APIs.
Background info
pubnub is vulnerable to Path Traversal in versions 4.29.0 - 12.0.0.
How to fix this
Upgrade the pubnub library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant