From ae290c4419ee592d8816966870ba6168e3cfb929 Mon Sep 17 00:00:00 2001 From: Jarrod Johnson Date: Wed, 1 Jul 2026 20:42:22 -0400 Subject: [PATCH] Ensure the filename cannot have path traversal in XCC2 and older --- confluent_server/aiohmi/ipmi/oem/lenovo/imm.py | 2 +- confluent_server/aiohmi/redfish/oem/lenovo/xcc.py | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/confluent_server/aiohmi/ipmi/oem/lenovo/imm.py b/confluent_server/aiohmi/ipmi/oem/lenovo/imm.py index 8657b30a..45157925 100644 --- a/confluent_server/aiohmi/ipmi/oem/lenovo/imm.py +++ b/confluent_server/aiohmi/ipmi/oem/lenovo/imm.py @@ -1348,7 +1348,7 @@ class XCCClient(IMMClient): {'Generate_FFDC_status': 1}) url = '/ffdc/{0}'.format(result['FileName']) if autosuffix and not savefile.endswith('.tzz'): - savefile += '-{0}'.format(result['FileName']) + savefile += '-{0}'.format(os.path.basename(result['FileName'])) fd = webclient.make_downloader(wc, url, savefile) while not fd.completed(): try: diff --git a/confluent_server/aiohmi/redfish/oem/lenovo/xcc.py b/confluent_server/aiohmi/redfish/oem/lenovo/xcc.py index 818f931b..1dca761f 100644 --- a/confluent_server/aiohmi/redfish/oem/lenovo/xcc.py +++ b/confluent_server/aiohmi/redfish/oem/lenovo/xcc.py @@ -1644,7 +1644,7 @@ class OEMHandler(generic.OEMHandler): {'Generate_FFDC_status': 1}) url = '/ffdc/{0}'.format(result['FileName']) if autosuffix and not savefile.endswith('.tzz'): - savefile += '-{0}'.format(result['FileName']) + savefile += '-{0}'.format(os.path.basename(result['FileName'])) fd = webclient.make_downloader(wc, url, savefile) while not fd.completed(): try: