Audit

Free Security Audits for Organizations

For a limited time, Enthion is offering free security auditing services to organizations, with a priority given to organizations benefitting their communities.

Contact: team@enthion.org

api/download.js

41  app.get('/download', (req, res) => {
42    const name = req.query.file
43    const base = path.join(__dirname, 'files')
44    return res.sendFile(path.join(base, name))45  })

Security Finding HIGH

Path traversal in file download

User-controlled filenames are joined directly into the download path, allowing traversal outside the intended files directory.