CVE-2026-117469— File-transfer type confusion permits unauthorized repository writes in Psono Server

Quick assessment

Affected

esaqa GmbH Psono

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Psono Server 社区版（CE）与企业版（EE）的 1.0.0 至 7.2.3 版本未对文件仓库操作中的文件传输凭证方向实施强制校验。拥有只读文件访问权限的已认证远程攻击者可向上传端点提交下载传输请求，从而获取针对攻击者选定对象密钥的已签名上传 URL，并借此向文件所有者所属文件追加数据块。该漏洞可导致攻击者上传或覆盖仓库对象，并消耗存储空间，其影响范围受传输大小、数据块数量及有效期限制。

CVSS 5.4 · Medium Updated Oct 27, 2026

Possible ATT&CK Techniques 3 AI

T1562 T1070 · Indicator Removal T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

File-transfer type confusion permits unauthorized repository writes in Psono Server

Source: CVE Program / CVE List V5

Vulnerability Description

Psono Server (CE & EE) versions 1.0.0 through 7.2.3 did not enforce the direction of file-transfer credentials on file-repository operations. An authenticated remote attacker with read-only access to a file could present a download transfer to the upload endpoint, obtain a signed upload URL for an attacker-selected object key, and append a chunk to the owner's file. Exploitation could upload or overwrite repository objects and consume storage, subject to transfer size, chunk-count, and lifetime limits.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

授权机制缺失

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
esaqa GmbH	Psono	1.0.0 ~ 7.2.4	-

II. Public POCs for CVE-2026-117469

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-117469

请登录查看更多情报信息。

Other References for CVE-2026-117469 (5)

https://gitlab.com/esaqa/psono/psono-server/-/commit/64753b19bd8d03cfbed20db575f4dccb220d9ca4 patch
https://gitlab.com/esaqa/psono/psono-server/-/releases/v7.2.4 release-notes
https://gitlab.com/esaqa/psono/psono-server/-/blob/v7.2.3/psono/restapi/serializers/file_repository_upload.py technical-description
https://gitlab.com/esaqa/psono/psono-server product
https://gitlab.com/esaqa/esaqa/security-advisories/-/blob/master/advisories/CVE-2026-117469.md vendor-advisory

https://www.cve.org/CVERecord?id=CVE-2026-117469

Same Patch Batch · esaqa GmbH · 2026-10-27 · 5 CVEs total

CVE-2026-117468	6.5 MEDIUM	Device-code claim permits restricted token escalation in Psono Server
CVE-2026-117470	6.5 MEDIUM	WebAuthn assertion replay permits second-factor bypass in Psono Server
CVE-2026-117471	5.4 MEDIUM	User-controlled Duo host permits authenticated SSRF in Psono Server
CVE-2026-117472	4.3 MEDIUM	URL prefix handling permits API key read-scope bypass in Psono Server

IV. Related Vulnerabilities

Same product: Psono

Same vendor: esaqa GmbH

Same weakness: CWE-862