CVE-2026-117469: File-transfer type confusion permits unauthorized repository writes in Psono Server
Psono Server (CE & EE) versions 1.0.0 through 7.2.3 did not enforce the direction of file-transfer credentials on file-repository operations. An authenticated remote attacker with read-only access to a file could present a download transfer to the upload endpoint, obtain a signed upload URL for an attacker-selected object key, and append a chunk to the owner's file. Exploitation could upload or overwrite repository objects and consume storage, subject to transfer size, chunk-count, and lifetime limits.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Psono Serverto a version that resolves this vulnerability.Fixed in 7.2.4
Event History
Frequently Asked Questions
Which deployments are affected?
Psono Server Community Edition and Enterprise Edition versions 1.0.0 through 7.2.3 are affected.
What access does an attacker need to exploit this issue?
An attacker must be authenticated and have read-only access to a file. They can use a download transfer credential against an upload endpoint.
What could an attacker do after exploitation?
The attacker could obtain a signed upload URL for an attacker-selected object key and append a chunk to the file owner's repository object. This may enable uploads or overwrites of repository objects and storage consumption, within transfer size, chunk-count, and lifetime limits.