Threats tagged 'ghsa-29j6-3xvc-79ff'

GenOffice versions up to 0.11.505 have an incorrect permission assignment vulnerability in the HTTP MCP server file store. This flaw allows local unprivileged users to read uploaded and generated documents by accessing a world-readable directory under the system temporary folder. The vulnerability bypasses HTTP bearer token protections, exposing client uploads and converted outputs to unauthorized local users.