Threats tagged 'ghsa-7jr3-j3rm-rx7w'

plugNmeet Server versions up to 2.5.2 have a path traversal vulnerability in the whiteboard conversion endpoint. This flaw allows any meeting participant to read arbitrary server files by supplying crafted filePath values containing ../ sequences. The vulnerability enables attackers to convert text or office documents into page images and then retrieve them without authentication via the /download/uploadedFile/ endpoint.