PT-2022-17783 · Qrcp · Qrcp

Starryloki · Published 2022-02-28 · Updated 2022-03-09 · CVE-2022-26315

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions qrcp versions 0.8.4 and earlier

Description The issue allows for ../ Directory Traversal via the file name specified by the uploader when qrcp is in receive mode. This can potentially lead to unauthorized access to files outside the intended directory.

Recommendations For versions 0.8.4 and earlier, consider restricting the receive mode functionality until a patch is available to prevent exploitation of the Directory Traversal vulnerability. As a temporary workaround, validate and sanitize file names provided by uploaders to prevent malicious directory traversal.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-26315

Affected Products

Qrcp

References · 5

• 🔥 https://github.com/claudiodangelis/qrcp/issues/223 · Exploit
• https://osv.dev/vulnerability/CVE-2022-26315 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-26315 · Security Note
• https://t.me/cibsecurity/38195 · Telegram Post
• https://t.me/cvenotify/27952 · Telegram Post