Hacdias

An issue exists when the software is hosted on a case-insensitive filesystem, such as Windows/NTFS, and both Signup and CreateUserDir are enabled. The system fails to account for case-insensitivity during self-registration home directory ownership checks. Consequently, two users registering with names that differ only by case (e.g., `CaseVictim` and `casevictim`) are treated as distinct accounts but are mapped to the same physical home directory. This occurs because the scope-ownership check performs an exact case-sensitive string comparison. An attacker can register a similar username to read, overwrite, or delete files belonging to another account via authenticated HTTP endpoints without requiring victim interaction.

A permission bypass exists in the '/api/resources' endpoint. The `resourceGetHandler` function fails to perform a `Perm.Download` check when processing the `checksum` parameter. This allows an authenticated user who is restricted from downloading files to obtain a content-hash oracle (supporting md5, sha1, sha256, and sha512) for any file within their scope. This flaw can be used to confirm guessed content, detect changes to files, or perform offline brute-force attacks on files with low entropy.

Authenticated users can bypass administrator-defined deny rules because the software fails to canonicalize paths before evaluating access rules. Path canonicalization is the process of converting a file path into a standard, unique representation. By using case-variant or backslash-separated paths, attackers can request files with alternate representations that do not match any deny rules but still resolve to the same filesystem object, resulting in unauthorized access to restricted files within their scope.

Authenticated users can write arbitrary data to disk because the software fails to enforce the declared `Upload-Length` in the TUS resumable-upload PATCH endpoint. This allows attackers to send oversized request bodies that exceed the declared upload length, potentially exhausting available disk space and causing service unavailability.

An issue exists where the software fails to honor the `createUserDir` isolation during proxy and hook authentication auto-provisioning paths. This allows attackers possessing valid upstream-authenticated credentials to exploit the server root scope assignment to read, modify, delete, and share files belonging to other users.

An issue exists in the TUS upload cache eviction mechanism that allows authenticated users with only Create permission to delete arbitrary files outside their assigned scope. An attacker can replace an ancestor directory with a symlink during the cache TTL (Time To Live) window to redirect the `os.Remove()` function call to a target outside the intended scope, bypassing ScopedFs scope guards and `Perm.Delete` checks.

An issue exists where the software fails to validate the expiration of JSON Web Tokens (JWT)—a compact, URL-safe means of representing claims to be transferred between two parties—when proxy authentication is configured using a non-default logout page. This allows attackers possessing a previously valid token to maintain indefinite access to protected routes and administrative endpoints. Additionally, expired tokens can be exchanged for new ones through the renewal endpoint.

Authenticated users can bypass path-based access controls during recursive copy, rename, and delete operations. The system fails to validate access rules for descendants, allowing an attacker to manipulate denied files by performing these operations on an allowed parent directory, which compromises rule-based isolation for confidentiality and integrity.

Authenticated users can leave stale public shares behind because the software fails to normalize paths before querying the share index in the `DeleteWithPathPrefix()` function. An attacker can delete a shared directory by using a path with a trailing slash and subsequently recreate the directory to expose new contents via the dormant public share URL.

An issue exists where the software fails to properly normalize file paths when creating zip or tar archives on Linux hosts. Specifically, the `getFiles()` function uses `filepath.ToSlash`, which does not convert backslashes on Linux. This allows an authenticated user with create permissions to upload files containing Windows-style traversal sequences (e.g., `....`) in the filename. These filenames are stored literally on the Linux filesystem and then included verbatim in the generated archive. When a victim downloads and extracts such an archive using Windows-based extractors (such as Windows Explorer, 7-Zip, or WinRAR), the backslashes are interpreted as path separators. This leads to an arbitrary file write, allowing files to be written outside the intended extraction directory on the victim's machine.

The issue arises when encoding data that contains a `Bytes` kind Node using the `json` codec, causing the encoder to panic as it does not expect to receive `Bytes` tokens. This should be treated as an error since plain JSON cannot encode bytes. The `dag-json` codec is not impacted, and neither is the use of `json` as a decoder. If the `json` codec is used to encode user-supplied data, it may be used as a vector for a denial of service attack.