Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
The application disables TLS certificate verification by default for all outgoing storage driver communications, making the system vulnerable to Man-in-the-Middle (MitM) attacks. This enables the complete decryption, theft, and manipulation of all data transmitted during storage operations, severely compromising the confidentiality and integrity of user data. Details Certificate verification is disabled by default for all storage driver communications. The TlsInsecureSkipVerify setting is default to true in the DefaultConfig() function in internal/conf/config.go. ~~~ func DefaultConfig() Config { // ... TlsInsecureSkipVerify: true, // ... } ~~~ This vulnerability enables Man-in-the-Middle (MitM) attacks by disabling TLS certificate verification, allowing attackers to intercept and manipulate all storage communications. Attackers can exploit this through network-level attacks like ARP spoofing, rogue Wi-Fi access points, or compromised internal network equipment to redirect…
Recommended action: Upgrade to 4.1.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The application contains a Path Traversal vulnerability (CWE-22) in multiple file operation handlers. An authenticated attacker can bypass directory-level authorisation by injecting traversal sequences into filename components, enabling unauthorised file removal and copying across user boundaries within the same storage mount. Details The application contains a Path Traversal vulnerability (CWE-22) in multiple file operation handlers in server/handles/fsmanage.go. Filename components in req.Names are directly concatenated with validated directories using stdpath.Join. This allows ".." sequences to bypass path restrictions, enabling users to access other users' files within the same storage mount and perform unauthorized actions such as deletion, renaming, or copying of files. FsRemove: ~~~ func FsRemove(c gin.Context) { // ... for , name := range req.Names { err := fs.Remove(c, stdpath.Join(reqDir, name)) ~~~ FsCopy: ~~~ func FsCopy(c gin.Context) { // ... if !req.Overwrite {…
Recommended action: Upgrade to 4.1.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.