CVE-2025-27413: PwnDoc Path Traversal RCE Vulnerability

CVE-2025-27413 Overview

CVE-2025-27413 is a path traversal vulnerability [CWE-22] in PwnDoc, an open-source penetration test reporting application. Versions prior to 1.2.0 allow an authenticated administrator to import raw data into the database through the backup restore functionality, including ../ sequences in template paths. The template update functionality subsequently uses these unsanitized paths to write file content, enabling arbitrary file write across the filesystem. An attacker with backups:create, backups:update, and templates:update permissions can overwrite application source code and achieve Remote Code Execution. Version 1.2.0 addresses the issue.

Critical Impact
Authenticated administrators can chain backup restore and template update operations to overwrite arbitrary files on the PwnDoc server, leading to Remote Code Execution.

Affected Products

PwnDoc (pwndoc_project) versions prior to 1.2.0
PwnDoc backend backup restore functionality (backend/src/routes/backup.js)
PwnDoc template update functionality (backend/src/routes/template.js)

Discovery Timeline

2025-02-28 - CVE-2025-27413 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-27413

Vulnerability Analysis

PwnDoc stores template metadata, including filesystem paths, inside its MongoDB backend. The backup restore endpoint accepts raw document data and inserts it directly into the database without validating path fields. When an administrator later triggers the template update flow, PwnDoc reads the stored path and writes the request body content to that location. Because the stored path may contain ../ traversal sequences, the write operation can escape the intended templates directory and target any file the PwnDoc process can access. Overwriting a JavaScript source file loaded by the Node.js backend yields Remote Code Execution the next time the file is required or the server restarts.

Root Cause

The root cause is missing input validation on filename and path fields during two related code paths. The backup restore route persists attacker-controlled path data into the Template model without sanitization. The template update route then trusts the persisted path and passes it to filesystem write APIs without normalizing or constraining it to a safe base directory. The pre-patch code also lacked a required check on the name parameter, so malicious names could propagate through the update handler.

Attack Vector

Exploitation requires an authenticated account holding the backups:create, backups:update, and templates:update permissions, which by default only administrators possess. The attacker crafts a backup archive containing a template document whose path field points outside the templates directory using ../ sequences. After restoring the backup, the attacker invokes the template update endpoint with malicious file content, causing PwnDoc to overwrite a target source file such as a backend route handler. Node.js executes the injected code on the next require or process restart.

javascript

// Security patch in backend/src/routes/template.js (commit 68aa1ea)
// Update template
app.put("/api/templates/:templateId", acl.hasPermission('templates:update'), function(req, res) {
    if (!req.body.name) {
        Response.BadParameters(res, 'Missing required parameters: name');
        return;
    }

    if (!utils.validFilename(req.body.name)) {
        Response.BadParameters(res, 'Bad name format');
        return;
    }

    // Fix for GHSA-2mqc-gg7h-76p6
    if (req.body.ext && !utils.validFilename(req.body.ext)) {
        Response.BadParameters(res, 'Bad ext format');
        return;
    }

    var template = {};
    // Required parameters
    template.name = req.body.name;
    
    // Optional parameters
    if (req.body.file && req.body.ext) template.ext = req.body.ext;

    Template.update(req.params.templateId, template)

Source: GitHub pwndoc Commit 68aa1ea. The patch enforces name presence and validates both name and ext fields through utils.validFilename before persisting them.

Detection Methods for CVE-2025-27413

Indicators of Compromise

Backup restore requests to /api/backups containing template documents with .. sequences in path or name fields.
Unexpected modification times on files under the PwnDoc backend source tree, especially route handlers in backend/src/routes/.
Template records in MongoDB whose name or ext fields fail the utils.validFilename check.
Node.js process restarts or unhandled exceptions immediately following template update API calls.

Detection Strategies

Inspect application logs for sequential POST /api/backups and PUT /api/templates/:templateId calls from the same administrator session.
Audit MongoDB templates collection contents for path traversal characters and reject documents that do not match a safe filename pattern.
Enable filesystem integrity monitoring on the PwnDoc installation directory to alert on writes outside backend/report-templates/.

Monitoring Recommendations

Forward PwnDoc backend logs and OS-level file audit events into a centralized logging platform for correlation.
Alert on any write operation performed by the PwnDoc process to files with .js extensions inside the application directory.
Track privileged API usage and flag administrator accounts that invoke both backup and template update endpoints within a short window.

How to Mitigate CVE-2025-27413

Immediate Actions Required

Upgrade PwnDoc to version 1.2.0 or later, which enforces filename validation on template fields.
Rotate administrator credentials and review recent activity from accounts holding backups:* and templates:update permissions.
Inspect the PwnDoc backend source tree for unauthorized modifications and reinstall from a trusted release if tampering is suspected.

Patch Information

The fix is available in PwnDoc Release v1.2.0 and applied in Commit 68aa1ea. Details are documented in GitHub Security Advisory GHSA-r3vj-47cf-4672. The patch requires the name parameter and validates both name and ext via utils.validFilename before database updates.

Workarounds

Restrict access to the PwnDoc administrative interface using network segmentation or a reverse proxy with IP allowlisting.
Remove backups:create, backups:update, and templates:update permissions from any non-essential accounts until the upgrade is applied.
Run the PwnDoc backend as an unprivileged user with write access limited to required directories to reduce blast radius.

bash

# Verify installed PwnDoc version and upgrade
cd /opt/pwndoc
git fetch --tags
git checkout v1.2.0
docker compose down
docker compose build --no-cache
docker compose up -d

# Confirm the patched template route enforces filename validation
grep -n "validFilename" backend/src/routes/template.js