Threats tagged 'ghsa-7hj3-vffx-jm3w'

Group-Office versions before 6.8.181, 25.0.116, and 26.0.58 have an arbitrary local file read vulnerability in the FolderController::actionProcessUploadQueue function. Authenticated users can exploit this flaw by supplying absolute paths in the blobs parameter to read server files. This can lead to exposure of other users' stored files and sensitive configuration files such as config.php containing database credentials.