Description
External Control of File Name or Path in the upload API endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows a remote attacker to write files to arbitrary locations outside the intended upload directory via relative or absolute path sequences.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Datiphy | Data Management Center | v8.3.0 – ≤ v8.5.1 | — |
References
- https://zuso.ai/advisory third-party-advisory