Arbitrary File Write

Overview Versions of iobroker.controller prior to 2.0.25 are vulnerable to Path Traversal. The package fails to restrict access to folders outside of the intended /adapter/ folder, which may allow attackers to include arbitrary files in the system. An attacker would need to be authenticated to...

PT-2019-12039

Name of the Vulnerable Software and Affected Versions iobroker.controller versions prior to 2.0.25 Description The issue allows an attacker to include file contents from outside the intended directory using the administrative web panel. This can be exploited by making a request for an adapter fil...