[BUG] Security: Path Traversal File Read Vulnerability in creative-ad-agent-server of Creative Ad Agent

[BruceJqs]

Describe the bug

A path traversal vulnerability (CWE-22) has been identified in the Creative Ad Agent SDK server, specifically within server/sdk-server.ts. The /images/:sessionId?/:filename endpoint accepts user-controlled route parameters and constructs a filesystem path without validating that the resolved path remains inside the intended generated-images directory. An attacker with network access to the server can supply encoded traversal sequences (e.g., %2e%2e/) to read arbitrary files accessible to the server process, including repository files or host system files such as /etc/hosts. Commit 751b9e5 is confirmed affected, and no fixed version is available at the time of reporting.

To Reproduce

1. Start the affected server

cd server
npm install
touch ../.env
npm start

2. Read a file outside the intended generated-images directory

curl -i --path-as-is 'http://127.0.0.1:3001/images/%2e%2e/README.md'

3. Read a host file

curl -i --path-as-is 'http://127.0.0.1:3001/images/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fetc/hosts'

Expected behavior

A clear and concise description of what you expected to happen.

Environment

• OS: MacOS
• Node.js version: 22.17.0
• Deployment: local

[BruceJqs]

Path Traversal File Read Vulnerability in creative-ad-agent-server of Creative Ad Agent

1) CNA / Submission Type

• Submission type: Report a vulnerability (CVE ID request)
• Reporter role: Independent security researcher
• Report date: Apr 12, 2026

2) Reporter Contact

• Reporter name: BruceJin
• Reporter email: brucejin@zju.edu.cn
• Permission to share contact with vendor: Yes

3) Vendor / Product Identification

• Vendor: DV0x
• Product: creative-ad-agent / creative-ad-agent-server
• Repository: https://github.com/DV0x/creative-ad-agent
• Affected component(s):
• server/sdk-server.ts

4) Vulnerability Type

• CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory)
• Short title: Path traversal in generated image serving endpoint

5) Affected Versions

• Confirmed affected: Commit751b9e5146604dc65049bd0f62dcbdad6212f8a3 (latest version)
• Suspected affected range: revisions containing the same request-to-sink flow listed below
• Fixed version: Not available at time of report

6) Vulnerability Description

A path traversal vulnerability (CWE-22) has been identified in the Creative Ad Agent SDK server, specifically within server/sdk-server.ts. The /images/:sessionId?/:filename endpoint accepts user-controlled route parameters and constructs a filesystem path without validating that the resolved path remains inside the intended generated-images directory. An attacker with network access to the server can supply encoded traversal sequences (e.g., %2e%2e/) to read arbitrary files accessible to the server process, including repository files or host system files such as /etc/hosts. Commit 751b9e5 is confirmed affected, and no fixed version is available at the time of reporting.

7) Technical Root Cause

1. js/file-access-from-request
   • Source: server/sdk-server.ts:776 (/images/:sessionId?/:filename)
   • Source: server/sdk-server.ts:777 (req.params)
   • Propagation: server/sdk-server.ts:781
   • Propagation: server/sdk-server.ts:782
   • Sink: server/sdk-server.ts:788
   • Sink code: if (!fs.existsSync(imagePath)) {
   • Sink: server/sdk-server.ts:797
   • Sink code: res.sendFile(imagePath, (err) => {

8) Attack Prerequisites

• Attacker can send HTTP requests to the Creative Ad Agent SDK server.
• The server exposes the /images/:sessionId?/:filename route.
• The server process has filesystem permissions to read the targeted file.
• No reverse proxy or external middleware normalizes or blocks encoded traversal sequences before the request reaches Express.

9) Proof of Concept / Reproduction Guidance

This proof of concept provides a concise, CVE-style reproduction example for the reported issue.

1. Start the affected server

cd server
npm install
touch ../.env
npm start

2. Read a file outside the intended generated-images directory

curl -i --path-as-is 'http://127.0.0.1:3001/images/%2e%2e/README.md'

3. Read a host file

curl -i --path-as-is 'http://127.0.0.1:3001/images/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fetc/hosts'

4. Validation

• Confirm that the first request returns repository README content instead of restricting access to generated images.
• Confirm that the second request returns host file content, demonstrating escape from the intended image storage directory.

10) Security Impact

• Confidentiality: High (arbitrary local file disclosure is possible).
• Integrity: None (the demonstrated endpoint reads and serves files).
• Availability: None (the demonstrated endpoint does not delete or overwrite files).
• Scope: Unchanged.

11) CVSS v3.1 Suggestion

• Suggested vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Suggested base score: 7.5 (High)
• Adjust PR upward if the affected server is strictly authenticated and not reachable by untrusted users.

12) Workarounds / Mitigations

• Do not expose the SDK server to untrusted networks until this endpoint is fixed.
• Block encoded traversal sequences such as %2e%2e, %2f, and %5c at a reverse proxy as a temporary mitigation.
• Run the server under a low-privilege account or container with access only to the intended image storage directory.

13) Recommended Fix

• Resolve the requested path against the intended generated-images base directory.
• After path normalization, verify that the final path remains inside the allowed base directory.
• Reject absolute paths and traversal sequences in sessionId and filename.
• Consider using res.sendFile(filename, { root: imagesDir }) with strict filename validation.
• Add regression tests for encoded traversal payloads and confirm files outside generated-images cannot be served.
• Publish a maintainer security advisory once a patch is released.

14) References

• Repository: https://github.com/DV0x/creative-ad-agent
• Reviewed source file: server/sdk-server.ts
• CWE-22: https://cwe.mitre.org/data/definitions/22.html

15) Credits

• Discoverer: BruceJin
• Discovery method: Static analysis (CodeQL) plus repository source-code audit and dynamic HTTP reproduction

16) Additional Notes for Form Mapping

• Audit verdict: Likely exploitable: attacker-controlled route parameters can escape the intended image directory and reach filesystem read sinks.
• Dynamic exploit replay status: completed for the /images/:sessionId?/:filename endpoint.
• Maintainer should validate release mapping before coordinated disclosure.

For furthermore information, please refer to BruceJqs/public_exp#17