Sync In Server Directory Traversal Vulnerability Allowing Unauthorized File Access

A directory traversal vulnerability has been identified in Sync In Server versions through 1.1.1. This vulnerability allows authenticated attackers to gain unauthorized read and write access to the system. The issue arises in the FilesManager.saveMultipart and FilesManager.compress functions, both located in the files-manager.service.ts file.

Impact

Exploitation of this vulnerability could lead to unauthorized access to files and the ability to modify them, potentially allowing for further exploitation of the application or its users.

Remediation

Users can update to Sync In Server version 1.2.0 or later, where this vulnerability has been patched.