Threats affecting pkg:github/trailbase

TrailBase versions from 0.28.2 up to but not including 0.35.10 contain an insecure direct object reference vulnerability. Authenticated attackers can manipulate file upload metadata to access or delete files owned by other users without proper ownership validation. This flaw allows reading victim files through the attacker's own records or causing permanent deletion by deleting or nulling their own records. The vulnerability also enables brute-force recovery of stripped file IDs using a filter technique. A fix is available in version 0.35.10.