Executive Summary

This vulnerability is a path traversal issue in FileCodeBox v2.2 and earlier. It allows remote attackers to write arbitrary files to the system by exploiting the save_file method, which uses user-supplied filenames without validation. Attackers can send specially crafted POST requests with malicious path traversal sequences to the /share/file/upload endpoint, which does not require authorization, enabling them to write files outside the intended directory.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can allow attackers to write arbitrary files anywhere on the server's filesystem, potentially leading to unauthorized data modification, system compromise, or the introduction of malicious files. Since the upload endpoint does not require authorization, attackers can exploit this remotely without credentials, increasing the risk of system integrity breaches.

Useful 0 Not Useful 0