Listen to this Post
The vulnerability exists in the lsfusion platform versions up to 6.1 within the `UploadFileRequestHandler` function in the file platform/web-client/src/main/java/lsfusion/http/controller/file/UploadFileRequestHandler.java. The function improperly handles the `sid` parameter during file upload requests. An attacker can manipulate this parameter to inject directory traversal sequences, such as ../. This allows the attacker to break out of the intended directory and write or access files in arbitrary locations on the server filesystem. The vulnerability is remotely exploitable without authentication, as it requires no special privileges or user interaction. The exploit leverages insufficient validation of user input before using it to construct filesystem paths. The publicly disclosed proof-of-concept demonstrates how a crafted HTTP request with a malicious `sid` value can lead to unauthorized file uploads to sensitive directories. This path traversal flaw can potentially result in remote code execution if critical files are overwritten, depending on server configuration and permissions.
Platform: lsfusion
Version: up to 6.1
Vulnerability: Path Traversal
Severity: Medium
date: 2025-11-17
Prediction: No patch date
What Undercode Say:
Analytics
curl -X POST -F “sid=../../../tmp/exploit” http://target/upload
find / -name “UploadFileRequestHandler.java” 2>/dev/null
grep -r “sid” platform/web-client/src/ –include=”.java”
How Exploit:
Manipulate sid parameter with traversal sequences.
Protection from this CVE
Update to patched version. Implement input sanitization. Use security filters.
Impact:
Unauthorized file access. Possible remote code execution.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
