Files vulnerabilities

Malicious content uploaded as a file can be used to execute script code when following attacker-controlled links. This can lead to unintended actions in the context of the user's account, including exfiltration of sensitive information.

Malicious content uploaded as a file can be used to execute script code when following attacker-controlled links. This can lead to unintended actions in the context of the user's account, including exfiltration of sensitive information.

The Files module for managing files in spaces and user profiles, prior to versions 0.16.11 and 0.17.2, has insufficient authorization checks allowing non-member users to create folders and upload/download files as a ZIP archive in public spaces. Private spaces are not affected.

The Files module in versions 0.16.9 and below lacks logic to prevent exploitation of backend SQL queries without direct output, potentially allowing unauthorized data access. This is fixed in version 0.16.10.

The Files module in versions 0.16.9 and below lacks logic to prevent injection of arbitrary JavaScript in the File Move functionality, which can lead to Browser JS code execution in the context of the user's session. This is fixed in version 0.16.10.