CVE-2024-40646: Vertex Path Traversal Vulnerability

CVE-2024-40646 Overview

CVE-2024-40646 is a path traversal vulnerability [CWE-22] in Vertex, a management tool used by Private Tracker (PT) users to manage streaming and watching videos. The flaw exists in versions prior to commit fbde301b97986d5913fc4bc95f5445750d282e11. The Vertex application fails to properly validate user-supplied paths in asset-serving routes, allowing remote attackers to read files outside the intended static directory. Exploitation requires no authentication and no user interaction, making the application accessible to network-based attackers. The vulnerability primarily impacts confidentiality, with limited integrity and availability consequences. Users running Vertex should upgrade to a version that contains the referenced patch commit.

Critical Impact
Unauthenticated remote attackers can traverse the file system through Vertex's asset routes and download files outside the intended static/ directory, exposing application secrets, configuration data, and other sensitive files.

Affected Products

Vertex (vertex-app/vertex) versions prior to commit fbde301b97986d5913fc4bc95f5445750d282e11
Vertex deployments exposing /assets, /workbox, or /service-worker.js routes
Vertex's /assets/styles/theme.less route on unpatched builds

Discovery Timeline

2026-06-01 - CVE-2024-40646 published to NVD
2026-06-01 - Last updated in NVD database

Technical Details for CVE-2024-40646

Vulnerability Analysis

Vertex is built on Node.js with Express. The router serves static assets by joining user-controlled URL path segments with a base directory using path.join. Because path.join resolves .. segments, an attacker can craft a request that escapes the intended static/ directory and reach any file readable by the Vertex process.

The vulnerable handlers include the /assets/styles/theme.less route and the catch-all handler that processes paths starting with /assets. Both routes pass the joined path directly to res.download() without verifying that the resolved path remains within the static asset directory.

Because the attack vector is network-based and authentication is not required, any reachable Vertex instance is exposed. The patch impact aligns with file disclosure: confidentiality is the dominant outcome, with limited write or denial-of-service potential.

Root Cause

The root cause is missing canonicalization checks after path concatenation. The application trusts the request pathname when constructing the file system path. Without verifying that the resolved absolute path begins with the static directory prefix, traversal sequences such as ../../etc/passwd are accepted and served.

Attack Vector

An attacker sends an HTTP request to a Vertex endpoint under /assets containing directory traversal sequences in the URL pathname. The server resolves the path, locates a file outside the intended directory, and returns its contents through res.download(). No credentials, tokens, or user interaction are required.

javascript

// Patch from app/routes/router.js — commit fbde301b97986d5913fc4bc95f5445750d282e11
// Before: path joined and downloaded without bounds check
// After: resolved path must start with the static directory prefix

app.use('/assets/styles/theme.less', (req, res) => {
  const _path = path.join(__dirname, '../static/assets/styles/' + (global.theme || 'follow') + '.less');
  if (!_path.startsWith(path.join(__dirname, '../static/'))) {
    res.status(404);
    return res.end('Not Found');
  }
  return res.download(_path, (err) => {
    if (!err) return;
    logger.error(err);
    res.status(404);
    return res.end('Not Found');
  });
});

app.use('*', (req, res, next) => {
  const pathname = req._parsedOriginalUrl.pathname;
  if (pathname === '/favicon.ico') {
    res.status(404);
    return res.end('Not Found');
  }
  if (pathname.startsWith('/assets') || pathname.startsWith('/workbox') || pathname.startsWith('/service-worker.js')) {
    const _path = path.join(__dirname, '../static', pathname);
    if (!_path.startsWith(path.join(__dirname, '../static/'))) {
      // request denied — traversal blocked
    }
  }
});

Source: GitHub Commit fbde301

Detection Methods for CVE-2024-40646

Indicators of Compromise

HTTP requests to Vertex endpoints under /assets, /workbox, or /service-worker.js containing .., %2e%2e, or URL-encoded traversal sequences.
Web server access logs showing successful 200 responses to /assets/... requests that return non-asset MIME types or unusually large payloads.
Outbound transfers of configuration files, credential stores, or .env files originating from the Vertex host shortly after suspicious asset requests.

Detection Strategies

Inspect reverse proxy and Node.js access logs for traversal patterns targeting Vertex asset routes.
Apply a Web Application Firewall (WAF) rule that blocks decoded .. sequences in any URL path served by Vertex.
Correlate file read events on the Vertex host with inbound HTTP requests to identify file disclosure attempts.

Monitoring Recommendations

Alert on any HTTP GET request to Vertex whose pathname contains .. or its encoded variants after URL decoding.
Monitor process file access by the Vertex Node.js process for reads outside its installation and static/ directory.
Track egress volume from Vertex instances and flag anomalous downloads following asset-route requests.

How to Mitigate CVE-2024-40646

Immediate Actions Required

Upgrade Vertex to a build that includes commit fbde301b97986d5913fc4bc95f5445750d282e11 or later.
Restrict network exposure of Vertex by binding it to localhost or placing it behind an authenticated reverse proxy.
Audit web and application logs for traversal patterns against /assets, /workbox, and /service-worker.js since the application was first deployed.

Patch Information

The fix is published in the Vertex repository at commit fbde301b97986d5913fc4bc95f5445750d282e11. The patch resolves the requested file path with path.join and then verifies the resolved path starts with the absolute static/ directory prefix before calling res.download(). Requests that escape the prefix return 404 Not Found. See the GitHub Security Advisory GHSA-92j5-qc36-23rr and the GitHub Commit Changes for full diff details.

Workarounds

Place Vertex behind a reverse proxy that strips or rejects .. and encoded traversal sequences in the request path.
Run Vertex under a low-privilege user account whose file system access is limited to the application directory.
Use container or filesystem-level isolation, such as a read-only root filesystem with only the static/ directory mounted, to constrain the blast radius of file disclosure.

bash

# Example NGINX reverse proxy rule to block traversal sequences in URLs hitting Vertex
location / {
    if ($request_uri ~* "(\.\./|\.\.\\|%2e%2e|%2f%2e%2e)") {
        return 404;
    }
    proxy_pass http://127.0.0.1:3000;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
}