CVE-2026-120522

Name of the Vulnerable Software and Affected Versions Cloud Storage Manager for Fluent Forms – Google Drive, Dropbox, OneDrive, S3 Uploads versions prior to 1.2.1

Description An arbitrary file write issue exists due to missing authorization checks on the 'connection/{driver}/save' and '/download/single-file' REST endpoints. Additionally, the downloadFile() function for Google Drive lacks sufficient path validation, as the name metadata value is concatenated into a local path without using basename(), sanitize file name(), or canonical path validation. This allows unauthenticated attackers to store controlled Google Drive credentials and trigger the download of a file with a provider-returned filename containing path traversal, enabling the writing of attacker-controlled content outside the intended downloads directory. If a file with a PHP extension is written to a web-accessible location, it can lead to remote code execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.