Threats tagged 'ghsa-2xw4-xqvw-cxg5'

Trudesk versions up to and including 1.2.11 have a path traversal and authorization bypass vulnerability in the accountsController.uploadImage function. Authenticated users can exploit this flaw by supplying crafted _id and username fields to overwrite other users' avatar images. The vulnerability bypasses prior sanitization attempts, allowing attackers to write image files outside the intended directory.