299ko Path Traversal Vulnerability in FileManagerAPIController

A path traversal vulnerability has been identified in 299ko versions through 2.0.0. The issue arises in the FileManagerAPIController.php file, specifically within the getSentDir and delete functions. This vulnerability allows remote attackers to manipulate file paths, potentially leading to unauthorized file deletion on the server.

Impact

Exploitation of this vulnerability allows for arbitrary file deletion on the server.

Reproduction

To reproduce this vulnerability, send a POST request to the 'view-ajax/delete' endpoint of the file manager. Include a crafted 'fmFolderToSee' parameter that exploits the path traversal vulnerability by navigating to a sensitive directory, and a 'filename' parameter specifying a file to be deleted.