Jotty.page Unauthenticated Path Traversal Vulnerability Allowing Sensitive File Disclosure

A path traversal vulnerability has been identified in jotty.page versions prior to 1.22.0. This vulnerability allows unauthenticated users to read files outside the intended directory by exploiting the filename parameter in the app-icons API endpoint. The lack of proper validation enables encoded traversal sequences to escape the designated directory, leading to unauthorized access to sensitive files, including user records, password hashes, and active session tokens.

Impact

Exploitation of this vulnerability allows for unrestricted file reading, with unauthenticated access to user records, password hashes, and active session-token mappings.

Remediation

Users can upgrade to jotty.page version 1.22.0 to address this vulnerability.