[GHSA-25pr-6pr6-68v7] Path traversal in atlasboard

[AryazE]

Updates

• Description

Comments
Add PoC exploit

[Copilot]

Pull Request Overview

This PR adds a Proof of Concept (PoC) exploit to a GitHub Security Advisory for a path traversal vulnerability in Atlasboard. The update demonstrates how the vulnerability can be exploited to read arbitrary files via the renderWidgetResource function.

• Adds a detailed JavaScript PoC code example showing exploitation method
• Updates the modified timestamp to reflect the change

Comments suppressed due to low confidence (1)

advisories/github-reviewed/2021/09/GHSA-25pr-6pr6-68v7/GHSA-25pr-6pr6-68v7.json:1

• The PoC code references fs module without importing it. Add const fs = require('fs'); at the top of the code block.

{

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[github-actions]

👋 This pull request has been marked as stale because it has been open with no activity. You can: comment on the issue or remove the stale label to hold stale off for a while, add the Keep label to hold stale off permanently, or do nothing. If you do nothing this pull request will be closed eventually by the stale bot. Please see CONTRIBUTING.md for more policy details.

[AryazE]

I was wondering if this is checked or not. Since there is no public exploit available for this vulnerability, this PR would be useful.

[shelbyc]

Hi @AryazE, my question here is the same as the question from #6093. I'd like to know how you found/developed the PoC and if there's information about it online anywhere other than this PR.

[AryazE]

I generated them with a tool (more details at https://arxiv.org/abs/2506.04962).
This CVE was among those that did not have a public PoC, and we could generate a working exploit for it.

[advisory-database]

Hi @AryazE! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future!