CVE-2025-59336: Luanox Path Traversal Vulnerability

CVE-2025-59336 Overview

Luanox is a module host for Lua packages built on the Phoenix web framework. CVE-2025-59336 is a path traversal vulnerability [CWE-22] affecting Luanox versions prior to 0.1.1. The rockspec verification system fails to filter package names containing directory traversal sequences such as ../../package. Attackers can upload packages with crafted names that write files to arbitrary relative paths on the server. When targeted carefully, this behavior can overwrite Phoenix runtime files and crash the website, resulting in denial of service.

Critical Impact
Unauthenticated attackers can overwrite Phoenix runtime files through crafted package names, causing denial of service against the Luanox host.

Affected Products

Luanox module host for Lua packages
All versions prior to 0.1.1
Deployments using the rockspec verification system

Discovery Timeline

2025-09-16 - CVE CVE-2025-59336 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-59336

Vulnerability Analysis

The vulnerability resides in the package upload path of Luanox. The rockspec verification system validates package metadata but does not reject package names that contain path traversal characters. When Luanox stores an uploaded package file, it uses the supplied package name as part of a relative file path. A package named ../../package therefore resolves outside the intended storage directory.

Because Luanox runs on the Phoenix web framework, attacker-controlled writes can land on runtime files that the application depends on. Overwriting these files crashes the Phoenix process and takes the site offline. The attack requires no authentication, no user interaction, and can be executed over the network.

Root Cause

The root cause is missing input validation on the :name field of the package changeset. The pre-patch code enforced presence, uniqueness, and length constraints but did not restrict the allowed character set. Path separators and traversal sequences passed validation and reached the file storage layer unchanged.

Attack Vector

An attacker submits a package upload where the package name embeds ../ traversal sequences. The rockspec verification passes, and Luanox writes the uploaded contents to a computed relative path that escapes the package directory. The attacker chooses a target path corresponding to a Phoenix runtime file to trigger denial of service.

text

     |> cast(attrs, [:name])
     |> validate_required([:name])
     |> unique_constraint(:name)
+    |> validate_format(:name, ~r/^[a-zA-Z0-9_\-]+$/)
     # Recast here to prevent the user from changing the package name
     |> cast(attrs, [:summary, :description])
     |> validate_length(:name, min: 1, max: 20)

Source: GitHub commit 2b6237f. The patch adds a validate_format/3 call that restricts package names to alphanumeric characters, underscores, and hyphens, blocking path separators and traversal sequences.

Detection Methods for CVE-2025-59336

Indicators of Compromise

Package upload requests where the name parameter contains ../, ..\, forward slashes, or backslashes.
Files appearing outside the configured Luanox package storage directory with recent modification timestamps.
Unexpected Phoenix application crashes or restart loops shortly after a package upload event.
HTTP 500 responses correlated with package publishing endpoints.

Detection Strategies

Inspect application and reverse-proxy logs for POST requests to Luanox package upload endpoints containing traversal patterns in the package name field.
Enable file integrity monitoring on Phoenix runtime directories to alert on unauthorized writes.
Correlate package upload events with subsequent process termination or supervisor restarts in BEAM VM logs.

Monitoring Recommendations

Alert on any write operations to Phoenix _build, priv, or release directories originating from the Luanox process.
Monitor Luanox package storage growth for files with unusual path components or names.
Track failed changeset validations after upgrading to confirm the patched validate_format rule rejects malicious inputs.

How to Mitigate CVE-2025-59336

Immediate Actions Required

Upgrade Luanox to version 0.1.1 or later, which applies the package name allowlist validation.
Audit the package storage directory for files with unexpected paths or names that predate the upgrade.
Verify integrity of Phoenix runtime files and redeploy the release if tampering is suspected.

Patch Information

The fix is delivered in Luanox 0.1.1. The patch adds validate_format(:name, ~r/^[a-zA-Z0-9_\-]+$/) to the package changeset, rejecting any name containing characters other than letters, digits, underscores, or hyphens. See the GitHub Security Advisory GHSA-42c5-x4pj-4p3w and the corresponding commits 2b6237f and 5198640.

Workarounds

If patching is delayed, place a reverse-proxy rule that rejects package upload requests whose name field contains /, \, or .. sequences.
Run the Luanox process under a dedicated OS user with write access limited to the package storage directory only.
Deploy Phoenix releases on a read-only filesystem where feasible, so runtime files cannot be overwritten at runtime.

bash

# Example nginx rule to block traversal in package names
location /packages {
    if ($request_body ~* "name=[^&]*(\.\./|\.\.\\|/|\\)") {
        return 400;
    }
    proxy_pass http://luanox_upstream;
}