| शीर्षक | GitHub badaso v3.0.0-alpha Badaso file API allows unauthenticated file deletion and file re |
|---|
| विवरण | Badaso exposes several file-management API routes without authentication or permission checks. An unauthenticated attacker can call /badaso-api/v1/file/delete, /badaso-api/v1/file/view, and /badaso-api/v1/file/download to delete, view, or download files from the configured storage disk.
An unauthenticated attacker can delete or read files managed by the application storage disk. This may lead to data exposure, disclosure of uploaded user files, data destruction, integrity loss, or application disruption. |
|---|
| स्रोत | ⚠️ https://github.com/uasoft-indonesia/badaso/issues/1100 |
|---|
| उपयोगकर्ता | Jeffwjy (UID 99232) |
|---|
| सबमिशन | 23/06/2026 02:55 PM (2 महीनों पहले) |
|---|
| संयम | 09/08/2026 03:12 PM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 387270 [Uasoft Badaso 3.0.0-alpha File API src/Routes/api.php ApiRequest::class अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|