Description
Multiple relative path traversal vulnerabilities in the oneup/uploader-bundle before 1.9.3 and 2.1.5 allow remote attackers to upload, copy, and modify files on the filesystem (potentially leading to arbitrary code execution) via the (1) filename parameter to BlueimpController.php; the (2) dzchunkindex, (3) dzuuid, or (4) filename parameter to DropzoneController.php; the (5) qqpartindex, (6) qqfilename, or (7) qquuid parameter to FineUploaderController.php; the (8) x-file-id or (9) x-file-name parameter to MooUploadController.php; or the (10) name or (11) chunk parameter to PluploadController.php. This is fixed in versions 1.9.3 and 2.1.5.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| 1up-lab | oneup/uploader-bundle | < 1.9.3, >= 2.0.0, < 2.1.5 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | oneup/uploader-bundle | >= 2.0.0, < 2.1.5 | 2.1.5 | GHSA-x8wj-6m73-gfqp |
| Packagist | oneup/uploader-bundle | >= 1.0.0, < 1.9.3 | 1.9.3 | GHSA-x8wj-6m73-gfqp |