PT-2022-14168 · Filegator · Filegator

Alcalbg · Published 2022-05-24 · Updated 2022-06-03 · CVE-2022-1850

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions filegator/filegator versions prior to 7.8.0

Description The issue is related to Path Traversal in the filegator/filegator GitHub repository. It affects non-admin users, where files created with .. as part of their name are interpreted as a path, allowing users to add filesystem entries outside their scope to their dashboard and modify those files.

Recommendations For versions prior to 7.8.0, update to version 7.8.0 or later to resolve the issue. As a temporary workaround, consider restricting the ability to create files with .. in their name to prevent path traversal exploitation.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-1850

GHSA-RRHW-54R8-545Q

Affected Products

Filegator

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/1xxx/CVE-2022-1850.json · Exploit
• 🔥 https://huntr.dev/bounties/07755f07-a412-4911-84a4-2f8c03c8f7ce · Exploit
• https://github.com/filegator/filegator/commit/6e2b68f17f48cdc1d6a4a93a2369d2069fe64989 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-1850 · Security Note
• https://osv.dev/vulnerability/GHSA-rrhw-54r8-545q · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-1850 · Vendor Advisory
• https://github.com/filegator/filegator · Note
• https://t.me/cibsecurity/43254 · Telegram Post