LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, authenticated non-administrative users could reach HandleTranslationFileUpload and in…
High CVSS 8.1
Summary
LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, authenticated non-administrative users could reach HandleTranslationFileUpload and influence the name passed from Controllers/FilesController.cs to RenameFile in Helper/FileHelper.cs. RenameFile constructed newFilePath with string replacement and moved the uploaded file without verifying the resolved absolute path remained under the web root or data directory. A crafted upload name …
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Sources
- NVD DATABASE
Original Links
- https://github.com/hargata/lubelog/commit/c8d5888ebc69e6a163e33f36200233ec845e5c57
- https://github.com/hargata/lubelog/issues/1398
- https://github.com/hargata/lubelog/pull/1395
- https://github.com/hargata/lubelog/releases/tag/v1.6.8
- https://github.com/hargata/lubelog/security/advisories/GHSA-qm5x-mmwx-q7rm
Timeline
- nvd_ingest NVD