LF Edge eKuiper is vulnerable to Arbitrary File Read/Write via unsanitized names and zip extraction in github.com/lf-edge/ekuiper

Description

References

• lf-edge/ekuiper security advisory · ADVISORY
• lf-edge/ekuiper commit 58362b0 · FIX
• lf-edge/ekuiper#3911 · FIX

More vulnerabilities in github.com/lf-edge/ekuiper

• CVE-2025-58363LF Edge eKuiper: Arbitrary File and Directory Deletion via Path Traversal in Plugin Installation Endpoint in github.com/lf-edge/ekuiper
• CVE-2025-24979LF Edge eKuiper: SSRF in External Service in github.com/lf-edge/ekuiper
• CVE-2025-24978LF Edge eKuiper: Self-XSS in External Service Creation in github.com/lf-edge/ekuiper
• GO-2025-3800eKuiper /config/uploads API arbitrary file writing may lead to RCE in github.com/lf-edge/ekuiper
• GO-2025-3799LF Edge eKuiper vulnerable to File Path Traversal leading to file replacement in github.com/lf-edge/ekuiper