Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Relative Path Traversal in oneup/uploader-bundle
Vulnerability Description
Multiple relative path traversal vulnerabilities in the oneup/uploader-bundle before 1.9.3 and 2.1.5 allow remote attackers to upload, copy, and modify files on the filesystem (potentially leading to arbitrary code execution) via the (1) filename parameter to BlueimpController.php; the (2) dzchunkindex, (3) dzuuid, or (4) filename parameter to DropzoneController.php; the (5) qqpartindex, (6) qqfilename, or (7) qquuid parameter to FineUploaderController.php; the (8) x-file-id or (9) x-file-name parameter to MooUploadController.php; or the (10) name or (11) chunk parameter to PluploadController.php. This is fixed in versions 1.9.3 and 2.1.5.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability Type
相对路径遍历
Vulnerability Title
OneuploaderBundle 路径遍历漏洞
Vulnerability Description
OneuploaderBundle是一个 Symfony 包，提供了一个服务器实现，用于使用 FineUploader、jQuery File Uploader、YUI3 Uploader、Uploadify、FancyUpload、MooUpload、Plupload 或 Dropzone 处理单个和多个文件上传。 OneuploaderBundle 1.9.3之前版本和2.1.5之前版本中存在路径遍历漏洞。攻击者可利用该漏洞向文件系统上的文件夹中上传任意文件。
CVSS Information
N/A
Vulnerability Type
N/A