PT-2024-32829

Name of the Vulnerable Software and Affected Versions Saltcorn versions prior to 1.0.0-beta16 Description A logged-in user with any role can delete arbitrary files on the filesystem by calling the /sync/clean sync dir endpoint. The dir name POST parameter is not validated/sanitized and is used to...