dhtmlxFileExplorer Directory Traversal Vulnerability Allowing Access to Sensitive Information

A directory traversal vulnerability has been identified in dhtmlxFileExplorer version 8.4.6. This vulnerability allows remote attackers to access sensitive information by exploiting the File Listing function. The issue arises from improper validation of file paths, enabling unauthorized access to system files through path traversal attacks.

Impact

Exploitation of this vulnerability allows unauthorized access to sensitive files on the server.

Reproduction

To reproduce this vulnerability, send a GET request to the File Listing function while including a crafted file path that traverses directories (e.g., using '../' sequences) to access sensitive system folders. The request must be made with the appropriate headers to mimic a standard browser request.