GHSA-c6f4-wj38-m3g3: Composer/snipe/snipe-it vulnerability
Impact The displaySig action in ActionlogController serves signature image files from a private upload directory. The filename parameter from the HTTP route is concatenated directly into a filesystem path with no sanitization, allowing an authenticated attacker to traverse outside the intended directory and read arbitrary files accessible to the web server process.
Reported by https://github.com/securin-public
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/snipe/snipe-itto a version that resolves this vulnerability.Fixed in 8.5.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to the application. They can exploit it if they can reach the displaySig action and submit a crafted filename route parameter.
What data could be exposed?
The flaw can expose arbitrary files outside the private upload directory, limited to files that the web server process can read.
How can I determine whether an instance is affected?
Review the ActionlogController displaySig action for direct concatenation of the HTTP route filename parameter into a filesystem path without sanitization or path-traversal controls.