CISA Thorium Insecure Downloaded File Path Validation

A path traversal vulnerability exists in CISA Thorium versions 1.0.0 prior to 1.1.2. The application fails to properly validate file paths for downloaded files through the 'download_ephemeral' and 'download_children' functions. This flaw allows remote, authenticated attackers to access arbitrary files, depending on file system permissions.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive files on the server, potentially allowing attackers to read confidential information or manipulate data.

Remediation

Users can upgrade to CISA Thorium version 1.1.2 to address this vulnerability.