Psono Server (CE & EE) versions 1.0.0 through 7.2.3 contain a vulnerability where the direction of file-transfer credentials is not enforced on file-repository operations. This flaw allows an authenticated attacker with read-only access to a file to misuse the upload endpoint to append data to files, potentially overwriting repository objects and consuming storage within certain operational limits.