| 제목 | YouTransfer 1.1.0 / 06b699ad30a976bfbd3cf47229547983eac796e2 Remote Code Execution |
|---|
| 설명 | YouTransfer 1.1.0 (commit 06b699ad30a976bfbd3cf47229547983eac796e2) contains a relative path traversal vulnerability in the template save functionality. The /settings/template endpoint accepts an attacker-controlled template filename and file contents and passes the filename to a file-write operation without canonicalizing the path or verifying that the resulting path remains within the intended template directory.
An unauthenticated remote attacker can exploit this issue to write arbitrary content to files at locations writable by the YouTransfer process. The vulnerability can be exploited without authentication because the affected administrative settings route does not enforce server-side authorization.
The vulnerable code ultimately performs a filesystem write using a path constructed by concatenating the application template directory with the attacker-controlled filename. No containment check is performed after path resolution. As a result, traversal sequences such as "../" can escape the intended template directory.
The arbitrary file write can be chained with the application's template rendering functionality to achieve server-side template injection and remote code execution. An attacker can write a malicious Nunjucks page template into the application's views/pages directory and subsequently request that page through the application's catch-all route, causing the server to evaluate the attacker-controlled template.
The issue was confirmed against an unmodified YouTransfer 1.1.0 installation. An unauthenticated attacker was able to write a file outside the application template directory and subsequently plant a malicious page template that resulted in command execution as the account running YouTransfer.
The vulnerability therefore allows unauthenticated remote code execution with the privileges of the YouTransfer process. In containerized deployments using the project's documented Dockerfile, no USER directive is specified, so the application process runs with root privileges inside the container.
The root cause is insufficient path validation in the template file-writing functionality. The application does not canonicalize the requested path and verify that the resolved destination remains within the permitted template directory before performing the file write. |
|---|
| 원천 | ⚠️ https://github.com/0xgh0stri13y/You-Transfer-Vuln |
|---|
| 사용자 | Alen Sebastian (UID 101289) |
|---|
| 제출 | 2026. 09. 16. AM 10:52 (1 월 ago) |
|---|
| 모더레이션 | 2026. 10. 12. PM 08:48 (26 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 417175 [YouTransfer 까지 0.0.7/1.0.6/1.1.0 Template Rendering /settings/template 디렉토리 순회] |
|---|
| 포인트들 | 20 |
|---|