Patryk Gruzska

A file placement issue exists, allowing assets to be uploaded to unintended server directories. This is due to improper limitation of a pathname to a restricted directory, specifically in the asset upload functionality. This enables users to upload files outside of the intended temporary directory.

The issue involves two critical security vulnerabilities that can be exploited by authenticated users. The first vulnerability is a Remote Code Execution (RCE) issue via asset upload, where insufficient enforcement of allowed file extensions allows an attacker to upload executable files, such as PHP scripts. The second vulnerability is a Path Traversal issue in the upload validation process, which enables an authenticated user to manipulate the file deletion process and delete arbitrary files on the host system. It is estimated that over 200,000 organizations are exposed to this vulnerability.