CVE-2022-50891
Cross-Site Scripting in Owlfiles 12.0.1 Download and List Endpoints
Publication date: 2026-01-13
Last updated on: 2026-02-02
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| skyjos | owlfiles_file_manager | 12.0.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Cross-Site Scripting (XSS) issue in Owlfiles File Manager version 12.0.1. It occurs because the application does not properly sanitize user input in the 'path' parameter of its HTTP server endpoints, specifically the 'download' and 'list' endpoints. Attackers can craft malicious URLs containing script tags in this parameter, which when accessed by users, execute arbitrary JavaScript code in their browsers. [1, 4]
How can this vulnerability impact me? :
The vulnerability allows attackers to execute arbitrary JavaScript in the context of the user's browser when they access a crafted URL. This can lead to malicious actions such as stealing session tokens, redirecting users to malicious sites, or performing actions on behalf of the user without their consent. Additionally, combined with other vulnerabilities in Owlfiles File Manager, attackers may access sensitive system files and directories, increasing the security risk on affected devices. [1, 4]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by testing the HTTP server endpoints for reflected cross-site scripting (XSS) via the 'path' parameter. You can craft URLs targeting the download and list endpoints with embedded script tags, such as: http://<target>:<port>/download?path=<script>alert(1)</script> or http://<target>:<port>/list?path=<script>alert(1)</script>. If the script executes in the browser, the vulnerability is present. Additionally, you can check for path traversal and local file inclusion by sending HTTP GET requests like: GET /../../../../../../../../../../../../../../../etc/hosts HTTP/1.1 to see if sensitive files are accessible. For FTP, commands like 'cd ../../../../../../../../../' followed by 'ls' can reveal directory traversal issues. [1, 4]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the Owlfiles File Manager HTTP and FTP servers to trusted networks or users, disabling the built-in HTTP and FTP servers if not needed, and avoiding clicking on or accessing URLs with suspicious or untrusted 'path' parameters. Applying input validation and sanitization on the 'path' parameter to prevent script injection is critical. If possible, update to a fixed version of the software once available or apply vendor-provided patches. Monitoring and blocking suspicious requests targeting the 'download' and 'list' endpoints can also help reduce risk. [1, 4]