Heym Path Traversal Vulnerability in File Upload Endpoint

A path traversal vulnerability has been identified in Heym versions prior to 0.0.21. This vulnerability allows authenticated users to upload files to arbitrary locations by exploiting the file upload endpoint. Attackers can manipulate the filename parameter with traversal sequences to bypass path restrictions, potentially leading to unauthorized file access or modification outside the designated storage directory.

Impact

Exploitation of this vulnerability allows for path traversal, enabling attackers to write, read, or delete files outside the intended storage directory.

Reproduction

The vulnerability can be reproduced by uploading a file through the file upload endpoint while including traversal sequences in the filename. This can be done by, for example, using a multipart filename that navigates up the directory structure, such as '../../../poc-owned-by-attacker.txt'.

Remediation

Users are advised to update to Heym version 0.0.21 or later, where this vulnerability has been fixed.