Q-Free MaxTime Path Traversal Vulnerability Allowing File Deletion

A path traversal vulnerability has been identified in Q-Free MaxTime versions through 2.11.0. This vulnerability allows authenticated remote attackers to delete sensitive files by sending crafted HTTP requests. The issue is located in the 'maxtime/api/database/database.lua' file.

Impact

Exploitation of this vulnerability could lead to unauthorized deletion of sensitive files, causing potential system instability or data loss.

Remediation

No official solution has been communicated by the vendor. However, it is recommended to restrict and monitor network access to the management web application on devices running Q-Free MaxTime versions through 2.11.0, until a patch is released.