The dashboard’s source-lines endpoint appended the requested file path to the project’s root directory without checking that the result stayed inside it, and returned the file’s contents. The same endpoint did not apply the per-key project restriction of API keys.
A caller with access to the dashboard could read any file readable by the operating-system account running CodeIndexer, outside every indexed project. From v0.9.0, when API keys could be used to sign in to the dashboard, a key restricted to one project could also read the source of other indexed projects. The effect is limited to reading files.
Web dashboard API — the source-lines endpoint (GET /api/source-lines) that the dashboard uses to display file excerpts.
Source modules:
src/mcp/dashboard.rs
Upgrade to CodeIndexer v0.12.0 or later. No alternative workaround is documented.
First fixed version: v0.11.0. Recommended upgrade: v0.12.0 or later, which includes the fixes for every advisory currently published in this collection.
v0.11.0 resolves the project before touching the file system, checks that the caller may access that project, canonicalises the project root and the requested path, and refuses any path that resolves outside the root. Error cases now return 400, 403 or 404 status codes instead of a successful response.
First affected version: v0.4.0 (release-tag commit) — the source-lines endpoint is added.
v0.9.0 (release-tag commit) — API keys can sign in to the dashboard; a project-restricted key can read other projects’ source through this endpoint.
Fix committed (57d3bfe0e679).
First fixed version: v0.11.0 (release-tag commit).
Advisory published.
Dates come from the project’s git history: fixes by their commit date, versions by the date of the commit their release tag points to — not necessarily the day a build became available for download.
57d3bfe0e679
2026-07-11
Project access check and path containment on the source-lines endpoint.
CodeIndexer is proprietary software. Commit references identify internal development history and correlate this advisory with our security-review evidence. Their publication does not make the proprietary source code public.
Questions about this advisory, or a new vulnerability to report: email [email protected] or open a private advisory on GitHub. See our security policy for the full disclosure process.
We use a couple of small first-party cookies to keep the site working and remember your theme preference. No tracking, no ads. Learn more.