Executive Summary

This vulnerability occurs because the upload endpoint does not properly validate the 'Upload-Key' request header. An authenticated attacker can use path traversal sequences in this header to make the server create upload-related files outside the intended storage area. Depending on the server configuration, this can allow arbitrary file writes and potentially enable remote code execution.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to severe impacts including unauthorized file creation outside designated directories, arbitrary file writes, and potentially remote code execution. This means an attacker could manipulate files on the server or execute malicious code, compromising the system's confidentiality, integrity, and availability.

Useful 0 Not Useful 0