CVE-2022-28052

The CVE-2022-28052 entry describes a directory traversal vulnerability in Roothub 2.6.0, specifically in the FileSystemStorageService.store function. An attacker with low privileges can exploit the /common/upload API to upload arbitrary files, potentially leading to remote code execution. The aff...

CVE-2022-28052: Improper Limitation of a Pathname to a Restricted Directory

Directory Traversal vulnerability in file cn/roothub/store/FileSystemStorageService in function store in Roothub 2.6.0 allows remote attackers with low privlege to arbitrarily upload files via /common/upload API, which could lead to remote arbitrary code execution...

PT-2022-18779

Name of the Vulnerable Software and Affected Versions Roothub version 2.6.0 Description The issue allows remote attackers with low privilege to arbitrarily upload files via the "/common/upload" API endpoint, which could lead to remote arbitrary code execution. This is due to a Directory Traversal...