Q-Free MaxTime Path Traversal Vulnerability Allowing File Overwrite

A path traversal vulnerability has been identified in Q-Free MaxTime versions through 2.11.0. The issue resides in the 'maxtime/api/database/database.lua' file, specifically within the copy endpoint. This vulnerability allows authenticated remote attackers to overwrite sensitive files by sending crafted HTTP requests.

Impact

Exploitation of this vulnerability could lead to unauthorized overwriting of sensitive files, causing data corruption or allowing privilege escalation.

Remediation

Until a patch is released, it is recommended to restrict and monitor network access to the management web application on devices running Q-Free MaxTime versions through 2.11.0.