| शीर्षक | leomoon-studios wiki-go <= 1.9.1 Path Traversal |
|---|
| विवरण | The /api/files/rename endpoint, reachable by any user with the editor role, accepts a JSON body with currentPath and newName. Neither value is validated against .., and both are joined under the documents directory before being passed to os.Rename. An editor can therefore relocate any file under the wiki data root — including config.yaml, static/, versions/, and comments/ — to any path within the same filesystem, escaping the documents/ sandbox. Relocating config.yaml forces the application to regenerate default credentials (admin/admin) on the next start, and relocating it into the documents tree as a .txt file discloses every user's password hash. Default configuration is affected.
|
|---|
| स्रोत | ⚠️ https://github.com/leomoon-studios/wiki-go/security/advisories/GHSA-xg75-vx57-m5mx |
|---|
| उपयोगकर्ता | mikannse (UID 100854) |
|---|
| सबमिशन | 08/10/2026 04:10 AM (14 दिन पहले) |
|---|
| संयम | 21/10/2026 01:12 PM (13 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 424732 [leomoon-studios wiki-go तक 1.9.1 Files Rename API files.go RenameFileHandler currentPath/newName निर्देशिका ट्रैवर्सल] |
|---|
| अंक | 20 |
|---|