Q-Free MaxTime Path Traversal Vulnerability Allowing File Deletion

A path traversal vulnerability has been identified in Q-Free MaxTime versions through 2.11.0, specifically within the template deletion mechanism. This vulnerability allows authenticated remote attackers to delete sensitive files by sending crafted HTTP requests. The issue could lead to system instability or data loss.

Impact

Exploitation of this vulnerability could result in the unauthorized deletion of sensitive files, causing potential system instability or data loss.

Remediation

Until a patch is released, it is recommended to restrict and monitor network access to the management web application on devices running Q-Free MaxTime versions through 2.11.0.