A flaw was found in yggdrasil-worker-package-manager. An authenticated attacker can exploit this issue to achieve arbitrary file modification or potential privilege escalation. The vulnerability exists because repository management operations fail to sanitize directory traversal sequences (such as '../') within repository names. By supplying a crafted repository name, an attacker can manipulate the root-level worker process into creating or deleting files outside the intended directory, compromising host system integrity.
=AddRepo()= and =RemoveRepo()= (=package_manager_dnf.go:22-37=) build the destination path with =filepath.Join("/etc/yum.repos.d/", canonicalizeRepoName(name, ".repo"))=. =canonicalizeRepoName()= (=util.go:13-15=) only replaces spaces with underscores and appends a =.repo= suffix — it never strips =/= or =..=. Because =filepath.Join= calls =filepath.Clean= internally, a broker-supplied =name= such as =../../etc/cron.d/evil= resolves outside =/etc/yum.repos.d/=, letting =os.WriteFile= write attacker-controlled content to any root-writable path ending in =.repo=, and =RemoveRepo='s =os.Remove= delete any such path. Neither function is gated by the =allowPatterns= allowlist. The worker's systemd unit runs =User=root=.
=AddRepo()= and =RemoveRepo()= (=package_manager_dnf.go:22-37=) build the destination path with =filepath.Join("/etc/yum.repos.d/", canonicalizeRepoName(name, ".repo"))=. =canonicalizeRepoName()= (=util.go:13-15=) only replaces spaces with underscores and appends a =.repo= suffix — it never strips =/= or =..=. Because =filepath.Join= calls =filepath.Clean= internally, a broker-supplied =name= such as =../../etc/cron.d/evil= resolves outside =/etc/yum.repos.d/=, letting =os.WriteFile= write attacker-controlled content to any root-writable path ending in =.repo=, and =RemoveRepo='s =os.Remove= delete any such path. Neither function is gated by the =allowPatterns= allowlist. The worker's systemd unit runs =User=root=.