Vulnerability	Vulnerable Version
H Directory Traversal Affected versions of this package are vulnerable to Directory Traversal via the `file-download` API endpoint in the `LocalStorage` process. An attacker can access arbitrary files on the server filesystem, including sensitive data such as embedded databases, secrets, and environment variables, by supplying specially crafted path parameters containing Windows-style backslashes to bypass path validation. How to fix Directory Traversal? Upgrade `io.kestra:core` to version 1.0.45, 1.3.21 or higher.	[,1.0.45)[1.1.0,1.3.21)
C Use of Password Hash With Insufficient Computational Effort Affected versions of this package are vulnerable to Use of Password Hash With Insufficient Computational Effort in the BasicAuth authentication process. An attacker can recover administrator credentials by performing offline brute-force attacks against SHA-512 password hashes obtained from the database. This may allow further compromise, such as accessing sensitive tokens and secrets, especially in Kubernetes environments. How to fix Use of Password Hash With Insufficient Computational Effort? Upgrade `io.kestra:core` to version 1.3.24 or higher.	[,1.3.24)

Directory Traversal

Affected versions of this package are vulnerable to Directory Traversal via the file-download API endpoint in the LocalStorage process. An attacker can access arbitrary files on the server filesystem, including sensitive data such as embedded databases, secrets, and environment variables, by supplying specially crafted path parameters containing Windows-style backslashes to bypass path validation.

How to fix Directory Traversal?

Upgrade io.kestra:core to version 1.0.45, 1.3.21 or higher.

[,1.0.45)[1.1.0,1.3.21)

Use of Password Hash With Insufficient Computational Effort

Affected versions of this package are vulnerable to Use of Password Hash With Insufficient Computational Effort in the BasicAuth authentication process. An attacker can recover administrator credentials by performing offline brute-force attacks against SHA-512 password hashes obtained from the database. This may allow further compromise, such as accessing sensitive tokens and secrets, especially in Kubernetes environments.

How to fix Use of Password Hash With Insufficient Computational Effort?

Upgrade io.kestra:core to version 1.3.24 or higher.

[,1.3.24)

Go back to all versions of this package