Devploit

Shared attachment handling fails to properly sanitize filenames controlled by an attacker when constructing the destination path. This allows a local malicious application to provide path components that escape the designated shared attachment directory, enabling the overwriting or corruption of files within the private data directory, such as message or account databases. Successful exploitation requires the app lock feature to be active via PIN or biometric authentication and necessitates user interaction to unlock the application.

Authenticated attackers with author-level access and above can write files with controlled content to arbitrary server locations. The issue occurs because the `layers[].id` parameter is not sanitized before being concatenated into a filesystem path and passed to the `copy()` function within the `move image on server()` function. This allows the use of traversal sequences to escape the intended upload directory. The attack is possible via the `save template` API endpoint, which is accessible to users with the `create projects` permission.

An Insecure Direct Object Reference (IDOR) exists due to missing validation on a user-controlled key, which allows unauthenticated attackers to bypass authorization and exploit incorrectly configured access control security levels to perform unauthorized actions.