| Titolo | WebStack-Guns Project (GitHub organization jsnjfz) WebStack-Guns 1.0 (latest master) Path Traversal / Arbitrary File Read (CWE-22) |
|---|
| Descrizione | WebStack-Guns 1.0 exposes /kaptcha/{pictureId} as a public endpoint and concatenates the attacker-controlled pictureId directly with the upload directory when reading files. Because no validation or canonicalization is performed, remote attackers can traverse directories and download arbitrary files readable by the service account, leading to high-impact information disclosure. |
|---|
| Fonte | ⚠️ https://github.com/Xzzz111/exps/blob/main/archives/WebStack-Guns-PathTraversal-1/report.md |
|---|
| Utente | sh7err04 (UID 92493) |
|---|
| Sottomissione | 10/11/2025 12:47 (11 mesi fa) |
|---|
| Moderazione | 30/11/2025 18:05 (20 days later) |
|---|
| Stato | Accettato |
|---|
| Voce VulDB | 333820 [jsnjfz WebStack-Guns 1.0 KaptchaController.java renderPicture directory traversal] |
|---|
| Punti | 20 |
|---|