Threats tagged 'ghsa-9fmm-h59x-wr53'

FrontAccounting versions before 2.4.20 have a path traversal vulnerability in the attachment upload handler. Authenticated attackers can exploit this by uploading files with traversal sequences in the unique_name parameter, allowing them to write files outside the intended directory into the web root. By uploading PHP files without extension validation, attackers can achieve remote code execution as the web server user.