Q-Free MaxTime Relative Path Traversal Vulnerability in File Upload Mechanism

A relative path traversal vulnerability has been identified in the file upload feature of Q-Free MaxTime versions through 2.11.0. This vulnerability allows authenticated remote attackers to overwrite arbitrary files by sending crafted HTTP requests.

Impact

Exploitation of this vulnerability could lead to unauthorized file overwriting, potentially causing system compromise or a denial-of-service condition.

Remediation

No official patch is available from the vendor. However, it is recommended to restrict and monitor network access to the management web application on devices running Q-Free MaxTime versions through 2.11.0.