id: PYSEC-2026-1194
published: "2026-07-07T16:02:58.794662Z"
modified: "2026-07-07T17:23:47.502955Z"
aliases:
- CVE-2025-55013
- GHSA-75jv-vfxf-3865
summary: "Assemblyline 4 service client vulnerable to Arbitrary Write through path traversal in Client code "
details: "**Path-Traversal -> Arbitrary File Write in Assemblyline Service Client**\n\n**IMPORTANT**: This vulnerability is valid if you decide to use the assemblyline-service-client outside of the normal practice to using Assemblyline in a production environment. In practice, this code should always be executed within a containerized environment such as [assemblyline-v4-service](https://github.com/CybercentreCanada/assemblyline-v4-service) which ensures filesystem-level permissions of what the running user is allowed to access. Furthermore, there is fewer chances for a MiTM compromise when deployed properly in a Docker or Kubernetes deployment where the platform will assign the correct network policies to secure connections between containers instead of relying on the user to set this up manually.\n\nSee https://github.com/CybercentreCanada/assemblyline/issues/382 for further discussion.\n\n---\n\n## 1. Summary  \nThe Assemblyline 4 **service client** (`task_handler.py`) accepts a SHA-256 value returned by the service **server** and uses it directly as a local file name.  \n> No validation / sanitisation is performed.\n\nA **malicious or compromised server** (or any MITM that can speak to client) can return a path-traversal payload such as  \n`../../../etc/cron.d/evil`  \nand force the client to write the downloaded bytes to an arbitrary location on disk.\n\n---\n\n## 2. Affected Versions  \n| Item | Value |\n|---|---|\n| **Component** | `assemblyline-service-client` |\n| **Repository** | [CybercentreCanada/assemblyline-service-client](https://github.com/CybercentreCanada/assemblyline-service-client) |\n| **Affected** | **All releases up to master branch.**  |\n\n\n---\n\n## 3. CVSS 3.1 Vector & Score  \n```\nCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L\n```\n\n\n---\n\n## 4. Technical Details\n\n| Field | Content |\n|---|---|\n| **Location** | `assemblyline_service_client/task_handler.py`, inside `download_file()` |\n| **Vulnerable Line** | `file_path = os.path.join(self.tasking_dir, sha256)` |\n| **Root Cause** | The `sha256` string is taken directly from the service-server JSON response and used as a file name without any validation or sanitisation. |\n| **Exploit Flow** | 1. Attacker (service server) returns HTTP 200 for `GET /api/v1/file/../../../etc/cron.d/evil`.<br>2. Client writes the response body to `/etc/cron.d/evil`.<br>3. Achieves arbitrary file write (code execution if file is executable). |\n\n---\n\n## 5. Impact  \n- **Integrity** – Overwrite any file writable by the service UID (often root).  \n- **Availability** – Corrupt critical files or exhaust disk space.  \n- **Code Execution** – Drop cron jobs, systemd units, or overwrite binaries.\n\n---\n\n## 6. Mitigation / Fix\n\n```python\nimport re\n\n_SHA256_RE = re.compile(r'^[0-9a-fA-F]{64}\\Z')\n\ndef download_file(self, sha256: str, sid: str) -> Optional[str]:\n    if not _SHA256_RE.fullmatch(sha256):\n        self.log.error(f\"[{sid}] Invalid SHA256: {sha256}\")\n        self.status = STATUSES.ERROR_FOUND\n        return None\n    # or your preferred way to check if a string is a shasum.\n```\n---"
affected:
- package:
    name: assemblyline-service-client
    ecosystem: PyPI
    purl: pkg:pypi/assemblyline-service-client
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 4.6.0.stable11
    - introduced: 4.6.1.dev0
    - fixed: 4.6.1.dev138
  versions:
  - 4.6.1.dev0
  - 4.6.1.dev1
  - 4.6.1.dev10
  - 4.6.1.dev100
  - 4.6.1.dev101
  - 4.6.1.dev102
  - 4.6.1.dev105
  - 4.6.1.dev106
  - 4.6.1.dev107
  - 4.6.1.dev108
  - 4.6.1.dev109
  - 4.6.1.dev110
  - 4.6.1.dev111
  - 4.6.1.dev112
  - 4.6.1.dev113
  - 4.6.1.dev114
  - 4.6.1.dev115
  - 4.6.1.dev116
  - 4.6.1.dev117
  - 4.6.1.dev119
  - 4.6.1.dev120
  - 4.6.1.dev121
  - 4.6.1.dev122
  - 4.6.1.dev123
  - 4.6.1.dev124
  - 4.6.1.dev125
  - 4.6.1.dev126
  - 4.6.1.dev128
  - 4.6.1.dev129
  - 4.6.1.dev13
  - 4.6.1.dev130
  - 4.6.1.dev131
  - 4.6.1.dev132
  - 4.6.1.dev133
  - 4.6.1.dev134
  - 4.6.1.dev135
  - 4.6.1.dev136
  - 4.6.1.dev137
  - 4.6.1.dev15
  - 4.6.1.dev16
  - 4.6.1.dev18
  - 4.6.1.dev2
  - 4.6.1.dev20
  - 4.6.1.dev21
  - 4.6.1.dev22
  - 4.6.1.dev23
  - 4.6.1.dev24
  - 4.6.1.dev25
  - 4.6.1.dev26
  - 4.6.1.dev27
  - 4.6.1.dev28
  - 4.6.1.dev31
  - 4.6.1.dev32
  - 4.6.1.dev33
  - 4.6.1.dev34
  - 4.6.1.dev35
  - 4.6.1.dev36
  - 4.6.1.dev37
  - 4.6.1.dev38
  - 4.6.1.dev39
  - 4.6.1.dev4
  - 4.6.1.dev40
  - 4.6.1.dev41
  - 4.6.1.dev42
  - 4.6.1.dev43
  - 4.6.1.dev44
  - 4.6.1.dev48
  - 4.6.1.dev49
  - 4.6.1.dev5
  - 4.6.1.dev50
  - 4.6.1.dev51
  - 4.6.1.dev52
  - 4.6.1.dev53
  - 4.6.1.dev54
  - 4.6.1.dev55
  - 4.6.1.dev56
  - 4.6.1.dev57
  - 4.6.1.dev58
  - 4.6.1.dev59
  - 4.6.1.dev60
  - 4.6.1.dev62
  - 4.6.1.dev63
  - 4.6.1.dev64
  - 4.6.1.dev65
  - 4.6.1.dev66
  - 4.6.1.dev67
  - 4.6.1.dev68
  - 4.6.1.dev69
  - 4.6.1.dev7
  - 4.6.1.dev72
  - 4.6.1.dev73
  - 4.6.1.dev74
  - 4.6.1.dev75
  - 4.6.1.dev76
  - 4.6.1.dev77
  - 4.6.1.dev78
  - 4.6.1.dev79
  - 4.6.1.dev80
  - 4.6.1.dev81
  - 4.6.1.dev82
  - 4.6.1.dev84
  - 4.6.1.dev85
  - 4.6.1.dev86
  - 4.6.1.dev87
  - 4.6.1.dev88
  - 4.6.1.dev89
  - 4.6.1.dev9
  - 4.6.1.dev90
  - 4.6.1.dev92
  - 4.6.1.dev93
  - 4.6.1.dev94
  - 4.6.1.dev95
  - 4.6.1.dev97
  - 4.6.1.dev98
  - 4.6.1.dev99
references:
- type: WEB
  url: https://github.com/CybercentreCanada/assemblyline/security/advisories/GHSA-75jv-vfxf-3865
- type: ADVISORY
  url: https://nvd.nist.gov/vuln/detail/CVE-2025-55013
- type: WEB
  url: https://github.com/CybercentreCanada/assemblyline-service-client/commit/351414e7e96cc1f5640ae71ae51b939e8ba30900
- type: PACKAGE
  url: https://github.com/CybercentreCanada/assemblyline-service-client
- type: PACKAGE
  url: https://pypi.org/project/assemblyline-service-client
- type: ADVISORY
  url: https://github.com/advisories/GHSA-75jv-vfxf-3865
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L