From 154dd93da2505cfbbcfd40cf955d24684363b924 Mon Sep 17 00:00:00 2001
From: Burlone <108557545+burlone0@users.noreply.github.com>
Date: Thu, 28 Nov 2024 18:16:07 +0100
Subject: [PATCH] Fix path traversal exploit (Ty Lawin0129)

Co-Authored-By: Lawin <56766256+lawin0129@users.noreply.github.com>
---
 routes/cloudstorage.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/routes/cloudstorage.js b/routes/cloudstorage.js
index c200d37..4971172 100644
--- a/routes/cloudstorage.js
+++ b/routes/cloudstorage.js
@@ -41,7 +41,7 @@ app.get("/fortnite/api/cloudstorage/system/:file", (req, res) => {
     if (req.params.file.includes("..")) return res.status(404).end();
         if (req.params.file.includes("~")) return res.status(404).end();
 
-    const file = path.join(__dirname, "..", "CloudStorage", req.params.file);
+    const file = path.join(__dirname, "..", "CloudStorage", path.basename(req.params.file));
 
     if (fs.existsSync(file)) return res.status(200).send(fs.readFileSync(file));