CVE-2024-39937

supOS 5.0 allows api/image/download?fileName=../ directory traversal for reading files...

CVE-2024-39937: Improper Limitation of a Pathname to a Restricted Directory

supOS 5.0 allows api/image/download?fileName=../ directory traversal for reading files...

PT-2024-28744

Name of the Vulnerable Software and Affected Versions supOS version 5.0 Description The issue allows directory traversal for reading files via the "api/image/download" endpoint, specifically when the fileName parameter contains ../. This enables unauthorized access to files on the system...