| शीर्षक | yushine innoshop 0/8/2 Arbitrary File Deletion |
|---|
| विवरण | Vulnerability Title: Path Traversal and Arbitrary File Deletion in Panel File Manager
Description:
An arbitrary file deletion vulnerability exists in the file management module of the application (specifically within FileManagerController::destroyFiles()). Although the endpoint DELETE /api/panel/file_manager/files is protected by auth:sanctum and EnsureUserIsAdmin middleware, the application fails to implement granular access control or path validation.
The controller directly accepts path and files parameters from user requests and passes them to the underlying file system operations without sanitization or directory containment checks (e.g., preventing access outside the intended base directory). An authenticated administrator can exploit this to perform path traversal, allowing the deletion of arbitrary files on the server's file system, potentially leading to a denial of service (DoS) or the disruption of critical application functionality by removing configuration or system files. |
|---|
| स्रोत | ⚠️ https://github.com/ofirbarum923-dot/small-web-vuln/issues/1 |
|---|
| उपयोगकर्ता | HackTen (UID 99047) |
|---|
| सबमिशन | 16/06/2026 03:55 PM (2 महीनों पहले) |
|---|
| संयम | 05/08/2026 04:05 PM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 386234 [yushine InnoShop तक 0.8.2 Files Endpoint panel-api.php destroyFiles निर्देशिका ट्रैवर्सल] |
|---|
| अंक | 20 |
|---|