GTONE ChangeFlow Path Traversal Vulnerability Allowing Code Download Without Integrity Check

A path traversal vulnerability has been identified in GTONE ChangeFlow, affecting all versions up to v9.0.1.1. This vulnerability allows improper limitation of a pathname to a restricted directory, enabling unauthorized access to files. Additionally, the vulnerability facilitates the download of code without any integrity check, raising concerns about the authenticity and safety of the retrieved files.

Impact

Exploitation of this vulnerability could lead to unauthorized file access and the download of potentially malicious code that could be executed in the user's environment.