PT-2026-70887 · Strategy11+1 · Formidable Digital Signatures+1
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Formidable Digital Signatures versions prior to 3.0.7
Description
Insufficient file path validation in the
delete file() function allows unauthenticated attackers to delete files on the server. This occurs during the standard entry-creation POST flow on forms that accept anonymous submissions by providing a controlled filename in the item meta[field id][content] parameter and the delete saved image flag.Recommendations
Update Formidable Digital Signatures to version 3.0.7 or later.
Fix
DoS
Relative Path Traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Formidable Digital Signatures
Formidable-Signature