Details on GHSA-wj85-328x-ww6r

[Zoey2936]

Three things first:

1. Thanks to @ValeLyris for the report: https://github.com/ZoeyVid/NPMplus/security/advisories/GHSA-wj85-328x-ww6r
2. Please update ASAP!
3. Upstream NPM is NOT affected

What happened

Context

If a location block in nginx does not end with a trailing slash and it serves static files via the alias directive it is possible for anyone who can access the location to also read all files from one higher folder level and all of its subfolders. This is sadly not documented on nginx.org for the alias directive and sadly this was unknown to me until today, sorry. (If you want to read more just search for "nginx alias path traversal" in your favourite search engine or you can read this mail thread: https://mailman.nginx.org/pipermail/nginx-devel/2023-July/C36V7SJGRTJRN5JOLBCULA3EAFDTHJDJ.html)

Path Traversal in NPMplus

Since this was unknown to me, I used this combination in two places:

1. for serving locally cached gravatar images; saved in /data/npmplus/gravatar, which means anyone who could open the NPMplus WebUI, could download any file in /data/npmplus.
2. for serving custom anubis images; saved in /data/anubis, which means anyone who could open a host protected by anubis IF you added custom images for anubis, had access to the entire NPMplus data folder.

Impact

• Since 2025-12-29-b1 (including): anyone with unauthenticated access to the NPMplus WebUI could download the keys.json and database.sqlite file, which means they could:

  • until 2026-04-04-b1 (excluding), create tokens for any accounts they want and with that had admin permissions for NPMplus. Since lua is included in NPMplus it allowed RCE within the container, if you have set PUID/PGID then limited to this permissions level. If NPMplus had access to php-fpm then RCE was also possible this way. This includes access to the whole NPMplus data folder including certificate private keys.
  • for any basic auth access-list username-password pair created until 2026-02-14-b1 (excluding): read the passwords in plaintext.
  • until now (2026-07-23-r1, excluding): read all user data (names, email, password hashes, shared totp secret, etc) and all settings (proxy host configs, etc.)
  • until now (2026-07-23-r1, excluding): read all DNS Provider credentials saved in the database in plaintext (they sadly can't be saved encrypted, I hope the dns persist acme challenge will be released soon)

• Since 2026-04-04-b1 (including): anyone who could open a host protected by anubis IF you added custom images for anubis:

  • same as for the NPMplus WebUI
  • additionally: access any file in the NPMplus data folder, including certificate private keys and any other (config) file in it

Recommendations

• Update now! There are no breaking changes between 2026-07-15-r1 and 2026-07-23-r1.
• If not already done: don't expose the NPMplus WebUI to the internet, keep it behind a secure LAN and/or VPN
• One small note: This was reported to me a few hours ago, while this issue existed for multiple months, I have no indication that this was exploited, but I cannot rule it out
• If untrusted users could open the NPMplus WebUI or if you used anubis with custom images:
  • should not be needed but delete the /opt/npmplus/npmplus/keys.json and restart the container
  • Rotate all your dns credentials now
  • check certificate transparency logs if stolen credentials were misused
  • while bcrypt 13 is safe, you might still want to think about rotating your password
  • Reenroll TOTP: The shared TOTP secret is saved as plaintext
  • Remember that user data (names, usernames, email addresses) could be exposed
  • If there were other credentials part of custom/advanced configs: rotate them
  • if you use basic auth with passwords saved before 2026-02-14-b1 (excluding) or saved in upstream npm: replace them
  • if this got exploited until 2026-04-04-b1: resetup and update NPMplus if you notice signs of RCE (check advanced/custom configs) and if you are still running this version: revoke/force renew all your certificates
  • If you used anubis with custom images: revoke/force renew all your certificates

[MilesTEG1]

Hello,
Thanks for the explanations.
In the case of NPMplus's WebUI isn't exposed to internet, does it be necessary to delete the key.json and rotate dns credentials etc... ?

[Zoey2936]

If only trusted users could open the WebUI since 2025-12-29-b1 and you didn't used anubis with custom images, then no, you are fine, but I would still recommend to update.

My own NPMplus instances could only be reached via VPN or my trusted home networks the whole time, so I did none of the things I mentioned above, except for updating.

[MilesTEG1]

If only trusted users could open the WebUI since 2025-12-29-b1 and you didn't used anubis with custom images, then no, you are fine, but I would still recommend to update.

My own NPMplus instances could only be reached via VPN or my trusted home networks the the whole time, so I did none of the things I mentioned above, except for updating.

My own NPMplus is only accessible from within my LAN or my vpn server on my router (WireGuard) since ever. And I don't use Anubis at all.
I already updated NPMplus as you told it should be done ASAP.
So I'm good 😮‍💨
Thanks for the answers 😇👍🏻