CVE-2024-36079 Information

Description

An issue was discovered in Vaultize 21.07.27. When uploading files there is no check that the filename parameter is correct. As a result a temporary file will be created outside the specified directory when the file is downloaded. To exploit this an authenticated user would upload a file with an incorrect file name and then download it.

Reference

https://github.com/DxRvs/vaultize_CVE-2024-36079