| Título | WebStack-Guns Project (GitHub organization jsnjfz) WebStack-Guns 1.0 (latest master) Path Traversal / Arbitrary File Read (CWE-22) |
|---|
| Descripción | WebStack-Guns 1.0 exposes /kaptcha/{pictureId} as a public endpoint and concatenates the attacker-controlled pictureId directly with the upload directory when reading files. Because no validation or canonicalization is performed, remote attackers can traverse directories and download arbitrary files readable by the service account, leading to high-impact information disclosure. |
|---|
| Fuente | ⚠️ https://github.com/Xzzz111/exps/blob/main/archives/WebStack-Guns-PathTraversal-1/report.md |
|---|
| Usuario | sh7err04 (UID 92493) |
|---|
| Sumisión | 2025-11-10 12:47 (hace 11 meses) |
|---|
| Moderación | 2025-11-30 18:05 (20 days later) |
|---|
| Estado | Aceptado |
|---|
| Entrada de VulDB | 333820 [jsnjfz WebStack-Guns 1.0 KaptchaController.java renderPicture recorrido de directorios] |
|---|
| Puntos | 20 |
|---|