Submit #886395: faveosuite faveo-helpdesk Commit: 6568aa4 External Control of System or Configuration Setting

Authenticated Arbitrary File Deletion in Faveo Helpdesk

Faveo Helpdesk's logo deletion endpoints pass a user-supplied URL query parameter directly to `unlink()` without any path validation. An authenticated admin user can delete any file accessible by the PHP process on the server, including application files, configuration files, and system files.

Affected Components

- **Commit**: 6568aa4
- **Files**:
- `app/Http/Controllers/Admin/helpdesk/SettingsController.php`, line 128–129
- `app/Http/Controllers/Admin/helpdesk/SettingsController2.php`, lines 258–259
- **Routes**:
- `GET /delete-logo?data1=<path>` → `SettingsController::deleteLogo`

Vulnerability Details

**CWE-22**: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)
**CWE-73**: External Control of File Name or Path
**Type**: Authenticated Arbitrary File Deletion
**CVSS:3.1**: AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H — **8.7 (High)**

Vulnerable Code

`app/Http/Controllers/Admin/helpdesk/SettingsController.php:128-129`:
```php
$path = $_GET['data1']; //get file path of logo image
if (!unlink($path)) {
```

`app/Http/Controllers/Admin/helpdesk/SettingsController2.php:258-259`:
```php
$path = $_GET['data1']; //get file path of logo image
if (!unlink($path)) {
```

The `data1` query parameter is read directly from `$_GET` with no validation, sanitization, or restriction to any particular directory.

Route Protection

Both routes are behind the `install`, `roles`, `auth`, `update` middleware group (`routes/web.php:84`), requiring an active admin session.

Proof-of-Concept

Delete the application's `.env` file (making the app non-functional and potentially revealing secrets on next boot):
```
GET /delete-logo?data1=/var/www/html/.env
```

Delete the application's `private.key` used for data decryption (`LibraryController.php:86`):
```
GET /delete-logo?data1=/var/www/html/storage/app/private.key
```

Delete system files (if PHP process has sufficient permissions):
```
GET /delete-logo?data1=/etc/cron.d/faveo
```

Impact

- **Denial of Service**: Deleting config files or key application PHP files renders the helpdesk inoperable.
- **Data loss**: Deleting encrypted data or the private key used to decrypt it causes permanent data loss.
- **Privilege escalation path**: Deleting `storage/framework/sessions/*` terminates all active sessions; deleting log files removes audit trails.

Remediation

Validate that the path is confined to the storage directory before calling `unlink()`:

```php
$path = realpath($_GET['data1']);
$allowed_dir = realpath(storage_path('app/logos'));
if (!$path || strpos($path, $allowed_dir) !== 0) {
abort(403, 'Invalid file path');
}
if (!unlink($path)) { ... }
```

Or use Laravel's `Storage` facade which constrains paths to configured disks:
```php
$filename = basename(request()->get('data1'));
Storage::disk('local')->delete('logos/' . $filename);
```

• Source: ⚠️ https://github.com/faveosuite/faveo-helpdesk/issues/8343
• User: geochen (UID 78995)
• Submission: 07/11/2026 12:51 (2 months ago)
• Moderation: 08/24/2026 17:45 (1 month later)
• Status: Accepted
• VulDB entry: 394713 [Faveo Helpdesk up to 2.0.3 Logo SettingsController.php unlink data1 path traversal]
• Points: 20