Subject: Re: NNCP path traversal attack.

From: "Jonathan Lane" <[email-masked]>
Date: Thu, 18 Sep 2025 23:28:59 -0700

On Thu Sep 18, 2025 at 9:46 PM PDT, Eugene Medvedev wrote:
> The included patch is my take on dealing with this by by limiting path
> traversal to
> below the configured full path. It does nothing about, e.g., symlinks,
> and I'm not sure anything should be done about those.

The usual protection against symlink traversal is running services in a
chroot jail, Docker, or some other imposed filesystem boundary.  I'm not
sure there's a good source-level fix for this that runs everywhere NNCP
does.

-- 
Jonathan Lane