Taylored webhook validation vulnerabilities
Date: 2025-06
Affected: npm/taylored
Attack vector: path-traversal
Category: vulnerability-disclosure
Severity: Critical
CWE: CWE-22
CWE-294
CWE-345
CWE-916

### Critical Security Advisory for Taylored npm package v7.0.7 - tag 7.0.5 #### Summary A series of moderate to high-severity security vulnerabilities have been identified specifically in version **7.0.7 of \`taylored\`**. These vulnerabilities reside in the "Backend-in-a-Box" template distributed with this version. They could allow a malicious actor to read arbitrary files from the server, download paid patches without completing a valid purchase, and weaken the protection of encrypted patches. **All users who have installed or generated a \`taysell-server\` using version 7.0.7 of \`taylored\` are strongly advised to immediately upgrade to version 7.0.8 (or later) and follow the required mitigation steps outlined below.** Versions prior to 7.0.7 did not include the Taysell functionality and are therefore not affected by these specific issues. #### Vulnerabilities Patched in v7.0.8 Version 7.0.8 addresses the following issues found in the v7.0.7 template: 1. **Path Traversal in Patch Download:** The patch download endpoint did not properly sanitize the user-provided \`patchId\`. An attacker could have crafted a request with path traversal sequences (e.g., \`../../etc/passwd\`) to read arbitrary files from the server's filesystem. The \`patchId\` is now sanitized to ensure only files within the intended patches directory can be accessed. 2. **Missing PayPal Webhook Validation:** The server endpoint did not cryptographically verify incoming payment notifications, allowi


Mitigations:

Architectural layers (MAESTRO):