CVE-2020-15097

loklak is an open-source server application which is able to collect messages from various sources, including twitter. The server contains a search index and a peer-to-peer index sharing interface. All messages are stored in an elasticsearch index. In loklak less than or equal to commit 5f48476, a path traversal vulnerability exists. Insufficient input validation in the APIs exposed by the loklak server allowed a directory traversal vulnerability. Any admin configuration and files readable by the app available on the hosted file system can be retrieved by the attacker. Furthermore, user-controlled content could be written to any admin config and files readable by the application. This has been patched in commit 50dd692. Users will need to upgrade their hosted instances of loklak to not be vulnerable to this exploit.

• CWE-22

• https://github.com/loklak/loklak_server/commit/50dd69230d3cd71dab0bfa7156682ffeca8ed8b9Patch, Third Party Advisory
• https://github.com/loklak/loklak_server/security/advisories/GHSA-7557-4v29-rqw6Third Party Advisory
• https://github.com/loklak/loklak_server/commit/50dd69230d3cd71dab0bfa7156682ffeca8ed8b9Patch, Third Party Advisory
• https://github.com/loklak/loklak_server/security/advisories/GHSA-7557-4v29-rqw6Third Party Advisory

Published

Feb 2, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-15091TenderMint from version 0.33.0 and before version 0.33.6 all…6.5
• CVE-2020-15092In TimelineJS before version 3.7.0, some user data renders a…4.8
• CVE-2020-15093The tough library (Rust/crates.io) prior to version 0.7.1 do…8.6
• CVE-2020-15094In Symfony before versions 4.4.13 and 5.1.5, the CachingHttp…8.8
• CVE-2020-15095Versions of the npm CLI prior to 6.14.6 are vulnerable to an…4.4
• CVE-2020-15096In Electron before versions 6.1.1, 7.2.4, 8.2.4, and 9.0.0-b…6.8
• CVE-2020-15098In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.…8.8
• CVE-2020-15099In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.…8.1
• CVE-2020-1510An information disclosure vulnerability exists when the win3…5.5
• CVE-2020-15100In freewvs before 0.1.1, a user could create a large file th…3.3
• CVE-2020-15101In freewvs before 0.1.1, a directory structure of more than …3.3
• CVE-2020-15102In PrestaShop Dashboard Productions before version 2.1.0, th…6.5