| शीर्षक | HBAI-Ltd Toonflow 1.1.1 Remote Code Execution |
|---|
| विवरण | The Toonflow application's update mechanism (/api/setting/about/downloadApp) downloads a ZIP file from a user-controlled URL without any integrity verification (no signature, no checksum, no domain allowlist). The ZIP is extracted without path traversal validation, and its contents are then copied directly over the application's own server code (data/serve/), web frontend (data/web/), prompt templates (data/skills/), and ML models (data/models/). An authenticated attacker can supply a URL pointing to a malicious ZIP file to achieve complete remote code execution by replacing the application's server-side JavaScript. |
|---|
| स्रोत | ⚠️ https://github.com/HBAI-Ltd/Toonflow-app/issues/96 |
|---|
| उपयोगकर्ता | Yu Bao (UID 88956) |
|---|
| सबमिशन | 08/04/2026 11:03 AM (19 दिन पहले) |
|---|
| संयम | 26/04/2026 10:16 AM (18 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 359660 [HBAI-Ltd Toonflow-app तक 1.1.1 downloadApp Endpoint downloadApp.ts z.url निर्देशिका ट्रैवर्सल] |
|---|
| अंक | 20 |
|---|