Threats tagged 'ghsa-w3x6-9pwc-5hvx'

Omnispace Agora Project versions before 26.10.0 have a path traversal vulnerability that allows attackers to write arbitrary files outside the intended temporary directory. This is achieved by supplying an unanchored tmpFolderName value in the upload destination path, potentially enabling remote code execution.