p PatchFirst

CVE-2026-42259

CVE-2026-42259 · Saltcorn: Open Redirect in `POST /auth/login` due to incomplete `is_relative_url` validation (backslash bypass)

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Saltcorn is an extensible, open source, no-code database application builder. Prior to versions 1.4.6, 1.5.6, and 1.6.0-beta.5, Saltcorn validates the post-login dest parameter with a string check that only blocks :/ and //. Because all WHATWG-compliant browsers normalise backslashes (\) to forward slashes (/) for special schemes, a payload such as /\evil.com/path slips through is_relative_url(), is emitted unchanged in the HTTP Location header, and causes the browser to navigate cross-origin to an attacker-controlled domain. The bug is reachable on a default install and only requires a victim who can be tricked into logging in via a crafted Saltcorn URL. This issue has been patched in versions 1.4.6, 1.5.6, and 1.6.0-beta.5.

CVSS 5.1 · Medium · EPSS 0.3% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • saltcorn

    Versions
    • < 1.4.6: Affected
    • >= 1.5.0-beta.0, < 1.5.6: Affected
    • >= 1.6.0-alpha.0, < 1.6.0-beta.5: Affected

    No fix published

  • @saltcorn/server npm

    Affected ranges
    • SEMVER: < 1.4.6

    Update to 1.4.6

  • @saltcorn/server npm

    Affected ranges
    • SEMVER: ≥ 1.5.0-beta.0, < 1.5.6

    Update to 1.5.6

  • @saltcorn/server npm

    Affected ranges
    • SEMVER: ≥ 1.6.0-alpha.0, < 1.6.0-beta.5

    Update to 1.6.0-beta.5

Original sources

Check your server →