Path Traversal Vulnerability in spacecookie Library: Broken Path Sanitization
Summary
HSEC-2025-0004: Broken Path Sanitization in spacecookie Library. Affects spacecookie versions >= 0.2.0.0, < 1.0.0.3. Fixed in 1.0.0.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The spacecookie library is a Haskell package designed to manage cookie-based sessions securely. It provides functions for sanitizing paths to prevent unauthorized access to files through path traversal attacks. However, a flaw in its path sanitization functions has exposed users to potential security risks.
Vulnerability Detail
The vulnerability arises from the spacecookie library's functions sanitizePath and sanitizeIfNotUrl, which are intended to eliminate .. components from file paths to prevent path traversal attacks. Due to a flaw in the comparison logic, these functions fail to properly sanitize paths, allowing attackers to potentially access sensitive files outside the intended directory. This issue has been addressed in version 1.0.0.3, which implements the correct comparison using equalFilePath.
How To Fix
Minimum fixed version
1.0.0.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for this vulnerability, as the best course of action is to upgrade to the patched version. However, users can implement additional checks in their application to validate paths before processing them.
Conclusion
The broken path sanitization in the spacecookie library poses a significant security risk, allowing for potential path traversal attacks. Users are strongly advised to upgrade to version 1.0.0.3 or later to ensure their applications are secure. Implementing additional path validation can also help mitigate risks until an upgrade is feasible.
See every vulnerability recorded for spacecookie →
FAQ
This vulnerability can allow attackers to exploit path traversal, potentially gaining access to sensitive files on the server.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without any signup.
If an immediate upgrade is not possible, ensure that your application implements strict path validation to mitigate the risk of path traversal attacks.
No, the spacecookie server executable is not affected by this vulnerability, as it has separate checks to reject malicious paths.
More details can be found in the official security advisory on GitHub at https://github.com/haskell/security-advisories/blob/generated/osv-export/2025/HSEC-2025-0004.json.
