Listen to this Post
The vulnerability in Dosage stems from an insecure file path construction mechanism during comic image downloads. While the base filename is sanitized to remove path traversal sequences (../), the file extension is sourced directly from the HTTP response’s `Content-Type` header without validation. An attacker controlling a malicious comic server or acting as a Man-in-the-Middle can craft a response with a `Content-Type` header containing path traversal sequences, such as image/png/../../../evil.php. During the save operation, the unsanitized extension is appended to the sanitized basename, resulting in a complete path like sanitized_name../../../evil.php. If the process has write permissions to parent directories, this allows for arbitrary file creation outside the intended target directory, potentially leading to remote code execution.
Platform: Dosage
Version: < 3.2
Vulnerability: Directory Traversal
Severity: High
date: 2025-11-04
Prediction: Patch 2025-11-11
What Undercode Say:
`curl -H “Content-Type: image/png/../../../test.php” http://malicious-comic-site/image.jpg`
`dosage –adlist /path/to/malicious_list.txt</h2>
<h2 style="color: blue;">ls -la /var/www/html/`
<h2 style="color: blue;">
How Exploit:
Craft an HTTP response with a malicious `Content-Type` header containing directory traversal sequences to write files outside the intended download directory.
Protection from this CVE
Update to Dosage version 3.2 or later. For older versions, apply the patch that sanitizes the `Content-Type` header value before using it as a file extension.
Impact:
Arbitrary file write, which can lead to remote code execution if a written file is subsequently executed or accessed by the server.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
