diff --git a/server/controllers/FileSystemController.js b/server/controllers/FileSystemController.js index 39663d23..4b0a94b3 100644 --- a/server/controllers/FileSystemController.js +++ b/server/controllers/FileSystemController.js @@ -113,7 +113,8 @@ class FileSystemController { return res.sendStatus(403) } - const filepath = Path.join(libraryFolder.path, directory) + let filepath = Path.join(libraryFolder.path, directory) + filepath = fileUtils.filePathToPOSIX(filepath) // Ensure filepath is inside library folder (prevents directory traversal) if (!filepath.startsWith(libraryFolder.path)) {