| عنوان | FedML-AI FedML <=0.8.9 Path Traversal |
|---|
| الوصف | A path traversal vulnerability (CWE-22) exists in the Android client of FedML. The client processes MQTT messages as task instructions and uses the dataSet parameter to construct filesystem paths without validation.
An attacker who can publish or tamper with MQTT messages can supply crafted path traversal payloads (e.g., ../../../../) to cause the client to access and enumerate arbitrary directories within the app’s accessible filesystem. |
|---|
| المصدر | ⚠️ https://github.com/AnalogyC0de/public_exp/issues/25 |
|---|
| المستخدم | Ana10gy (UID 93358) |
|---|
| ارسال | 18/03/2026 09:40 AM (28 أيام منذ) |
|---|
| الاعتدال | 04/04/2026 08:40 AM (17 days later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 355288 [FedML-AI FedML حتى 0.8.9 MQTT Message FileUtils.java dataSet اجتياز الدليل] |
|---|
| النقاط | 20 |
|---|