9front Mothra HTML File Upload Default Value Vulnerability

A vulnerability in the Mothra web browser component of 9front allows websites to set default file paths for file upload forms. This could be exploited by an attacker who crafts a website with a malicious default file path and hides the form element from the user. When the form is submitted, it could unintentionally leak files from the user's namespace.

Impact

Exploitation of this vulnerability could result in unauthorized file disclosure, leaking user files to the server without their knowledge.

Remediation

The vulnerability has been addressed in a recent commit, which clears any default values set by websites for file input types. Users should update to the latest version of 9front to mitigate this issue.