vetkit.js.path-traversal.multer-original-name
multer disk storage saves uploads under the client-supplied file.originalname. A name such as ../../app/server.js writes outside the upload directory and can overwrite application files.
Last updated:
Suite: Security
javascript, typescript
multer disk storage saves uploads under the client-supplied file.originalname. A name such as ../../app/server.js writes outside the upload directory and can overwrite application files.
Category: SECURITY · Engine rule severity: WARNING
How to fix it
Generate the stored name on the server (e.g. crypto.randomUUID() plus a validated extension from path.extname) and keep the original name only as metadata.
References
Source: packages/engine/rules/sast/javascript.yml.
Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.