| 제목 | volotat Anagnorisis 0.4.0 Path Traversal |
|---|
| 설명 | An improper file boundary validation vulnerability exists in volotat Anagnorisis 0.4.0. Multiple Socket.IO handlers accept client-controlled file paths and use them for file reads, writes, moves, metadata sidecar access or video-stream registration without canonicalizing the path and verifying that it remains under the configured media directory.
The affected operations include the text get_file_content and save_file_content events, the image move_files event, the video start_streaming event, shared image/music/video metadata handlers, and optional trash handlers when file deletion is enabled. These locations share the same missing directory-containment security boundary and are reported as one vulnerability.
The issue was reproduced independently of the separate Socket.IO authentication flaw by using a validation harness that rejects unauthenticated clients and accepts only an authorized client. The original text handler overwrote a synthetic module page outside the configured media root. Anagnorisis reads module page.html files and passes their content to render_template_string, so the safe proof of concept wrote only the arithmetic Jinja expression {{ 7 * 7 }} and observed the rendered value 49. Separate source-exact tests confirmed moving a synthetic outside file through the image handler and registering an outside synthetic video path for streaming. No operating-system command execution or real sensitive file access was attempted. |
|---|
| 원천 | ⚠️ https://note-hxlab.wetolink.com/share/O7wlVHed7mQd |
|---|
| 사용자 | hiro (UID 93548) |
|---|
| 제출 | 2026. 07. 29. AM 02:27 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 09. 24. PM 12:12 (2 months later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 409322 [volotat Anagnorisis 까지 0.4.2 page.html 디렉토리 순회] |
|---|
| 포인트들 | 20 |
|---|