MiniGal Nano Path Traversal Vulnerability in Photo Directory

A path traversal vulnerability has been identified in MiniGal Nano versions through 0.3.5. The issue resides in index.php, where the dir parameter is manipulated to traverse the file system. Although the application attempts to sanitize user input by removing dot-dot sequences, this measure can be circumvented with specially crafted directory patterns. Exploiting this vulnerability allows an attacker to access and disclose image files from unintended locations on the server that are readable by the web server.

Impact

Exploitation of this vulnerability leads to unauthorized enumeration and disclosure of image files from sensitive or unintended locations on the file system.