| عنوان | Upsonic <=v0.55.6 Path Traversal: '..\filedir' |
|---|
| الوصف | Attackers can exploit a directory traversal vulnerability by manipulating the filename parameter in the file upload function to create arbitrary files on the target host. The vulnerability originates from line 39 in markdown/server.py, where the code file_path = os.path.join(temp_dir, file.filename) does not sanitize the file.filename.
|
|---|
| المصدر | ⚠️ https://github.com/Upsonic/Upsonic/issues/356 |
|---|
| المستخدم | Anonymous User |
|---|
| ارسال | 09/06/2025 10:42 AM (1 سنة منذ) |
|---|
| الاعتدال | 19/06/2025 08:53 AM (10 days later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 313282 [Upsonic حتى 0.55.6 markdown/server.py os.path.join file.filename اجتياز الدليل] |
|---|
| النقاط | 19 |
|---|