| 제목 | WebStack-Guns Project (GitHub organization jsnjfz) WebStack-Guns 1.0 (latest master) Path Traversal / Arbitrary File Read (CWE-22) |
|---|
| 설명 | WebStack-Guns 1.0 exposes /kaptcha/{pictureId} as a public endpoint and concatenates the attacker-controlled pictureId directly with the upload directory when reading files. Because no validation or canonicalization is performed, remote attackers can traverse directories and download arbitrary files readable by the service account, leading to high-impact information disclosure. |
|---|
| 원천 | ⚠️ https://github.com/Xzzz111/exps/blob/main/archives/WebStack-Guns-PathTraversal-1/report.md |
|---|
| 사용자 | sh7err04 (UID 92493) |
|---|
| 제출 | 2025. 11. 10. PM 12:47 (11 개월 ago) |
|---|
| 모더레이션 | 2025. 11. 30. PM 06:05 (20 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 333820 [jsnjfz WebStack-Guns 1.0 KaptchaController.java renderPicture 디렉토리 순회] |
|---|
| 포인트들 | 20 |
|---|