Description
A flaw has been found in rachelos WeRSS we-mp-rss up to 1.4.8. Impacted is the function download_export_file of the file apis/tools.py. Executing a manipulation of the argument filename can lead to path traversal. The attack can be launched remotely. The exploit has been published and may be used.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| rachelos | WeRSS we-mp-rss | 1.4.0, 1.4.1, 1.4.2, 1.4.3, 1.4.4, 1.4.5, 1.4.6, 1.4.7, 1.4.8 | — |
References
- VDB-344933 | rachelos WeRSS we-mp-rss tools.py download_export_file path traversal vdb-entry technical-description
- VDB-344933 | CTI Indicators (IOB, IOC, TTP, IOA) signature permissions-required
- Submit #752763 | rachelos WeRSS WeRSS<=1.4.8 Pathname Traversal third-party-advisory
- https://www.notion.so/WeRSS-Path-Traversal-Vulnerability-Leads-to-Arbitrary-File-Read-2feea92a3c41804da1f1f5ddbf86e655 exploit