From da24a3c93abf1a72c4a23d8943fbdd1c03264737 Mon Sep 17 00:00:00 2001 From: anupamme Date: Wed, 26 Aug 2026 20:12:20 +0000 Subject: [PATCH] fix: utils.custom.path-traversal-open security vulnerability Automated security fix generated by OrbisAI Security --- CveRecords5.0Upload.py | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/CveRecords5.0Upload.py b/CveRecords5.0Upload.py index 094c1a221..e6b8cbcb9 100644 --- a/CveRecords5.0Upload.py +++ b/CveRecords5.0Upload.py @@ -26,7 +26,10 @@ def main(argv): if inputPath: for subdir, dirs, files in os.walk(inputPath): for file in files: - with open(inputPath + '/' + file) as json_file: + filepath = os.path.realpath(os.path.join(subdir, file)) + if not filepath.startswith(os.path.realpath(inputPath) + os.sep): + continue + with open(filepath) as json_file: data = json.load(json_file) cve_id = data.get('cveMetadata', {}).get('id') params = {'id': cve_id} @@ -37,7 +40,8 @@ def main(argv): r = requests.put( RSUS_URL + cve_id, headers=headers, - data=json.dumps(data) + data=json.dumps(data), + timeout=30 )