CVE-2021-41714

In Tipask 3.5.9, path parameters entered by the user are not validated when downloading attachments, a registered user can download arbitrary files on the Tipask server such as .env, /etc/passwd, laravel.log, causing infomation leakage...

CVE-2021-41714

creationtimestamp| type| source ---|---|--- 2022-05-23 20:41:56+00:00| seen| https://t.me/cibsecurity/43177 2025-05-01 21:03:05+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3lo57i2a7js2e...

CVE-2021-41714

In Tipask 3.5.9, path parameters entered by the user are not validated when downloading attachments, a registered user can download arbitrary files on the Tipask server such as .env, /etc/passwd, laravel.log, causing infomation leakage...

CVE-2021-41714

Tipask versions prior to 3.5.9 are vulnerable to an information leakage flaw because user-provided path parameters are not validated during attachment downloads. A registered user can exploit this to download arbitrary files from the server, such as .env , /etc/passwd , or laravel.log . No specif...