| عنوان | PMWeb v7.x, v8.x, v2025.x Path Traversal / Arbitrary File Read |
|---|
| الوصف | A vulnerability was identified in the Downloader component (downloader.aspx) of PMWEB Project Management Platform. The endpoint accepts the FullFileName and FileName request parameters as raw file system paths without applying any validation, allowlisting, or path restriction.
As a result, a requester is able to supply an arbitrary file path and retrieve files from any folder on the server, rather than being limited to the operational files the Downloader was intended to serve. This allows unauthorized disclosure of any file accessible to the web application process, including configuration files, source code, and other sensitive server-side resources.
POC Steps
1. Identify a PMWEB server exposing the downloader.aspx endpoint.
2. Send a request to downloader.aspx supplying a FullFileName parameter containing a path to a file outside the intended operational directory (e.g., a system or application configuration file).
3. Observe that the server returns the requested file content without validating that the path falls within an authorized directory.
4. Repeat with different file paths to confirm files from arbitrary folders on the server can be retrieved.
Credits
The following individuals and organizations are credited for the discovery and coordination of these findings:
● Abdullah AlJaber
● Abdulmajeed AlDayel
● Mohammad AlHumaid
● Saudi Arabia National Cybersecurity Authority (NCA)
● Saudi Information Technology Company (SITE) |
|---|
| المستخدم | aljaber (UID 99098) |
|---|
| ارسال | 15/08/2026 02:22 AM (2 أشهر منذ) |
|---|
| الاعتدال | 27/09/2026 08:47 PM (1 month later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 410954 [PMWeb 7.x/8.x/2025.x downloader.aspx FullFileName/FileName اجتياز الدليل] |
|---|
| النقاط | 17 |
|---|