Threats tagged 'ghsa-6vrq-vfh4-v7v2'

FilePress versions through 3.0.1 have a missing authorization vulnerability in the dzz/pichome/library component. This flaw allows authenticated users to manage folders in other libraries because the permission check only verifies membership in any library, not the specific target library. Attackers who know another library's appid or folder id can perform operations such as deleting, renaming, or reading folders they do not own.