Alijonov Alisher

An OS Command Injection issue exists in the media upload thumbnail generation routine. The `Media.generateThumbnail()` function in `src/Server/Entity/Resource/Media.js` creates a temporary file path using `Path.extname(filename)` and passes it unescaped to a shell command executed via `AppService.exec()`. Because the MIME-type filter in `getMIMEType()` (located in `src/Common/utilities.js`) truncates extensions at the first '?' character while `Path.extname()` does not, an authenticated user with media resource scope can bypass image-type checks. By using a filename like `x.jpg?$(command)`, an attacker can execute arbitrary OS commands within the context of the Node.js process via the POST '/api/{project}/{environment}/media/new' endpoint.

The Git deployer component contains an OS Command Injection flaw. The `pullRepo()` function in `src/Server/Entity/Deployer/GitDeployer.js` uses `AppService.exec()` to run a shell command that interpolates the configured branch value without proper escaping. While the `validate()` function rejects single quotes, it fails to filter other shell metacharacters such as `;`, `&&`, `|`, backticks, and `$()`. An attacker with permissions to configure Git deployer settings can specify a malicious branch value that executes arbitrary commands automatically during deployer operations, such as content saves or media uploads.

The admin file-management feature fails to properly restrict dangerous file uploads. The system uses a fixed blacklist in `data/inc/files.php` that checks the last 4-5 characters of a filename but omits the `.php8` extension. An authenticated administrator can upload a file with the `.php8` extension, which is stored unmodified. On servers running PHP 8.x, the web server executes this file as PHP, leading to remote code execution.

An authorization bypass exists in the attachment download route. The `Download()` function, located in `domain/attachment/endpoint.go`, accepts a `secure` query parameter but only verifies that the parameter is not empty rather than validating it against a stored value. Consequently, providing any non-empty string in the `secure` parameter allows an attacker to bypass authentication and download attachments from any organization.