Description
Heym before 0.0.21 contains a path traversal vulnerability in the file upload endpoint that allows authenticated users to write attacker-controlled files to arbitrary locations by supplying a crafted filename with traversal sequences. Attackers can exploit the unvalidated filename parameter in the upload_file() handler to bypass path restrictions and write, read, or delete files outside the intended storage directory.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
heymrun heym
Default version status: affected
0 to < 0.0.21affected835843e6d2bf7d018cbb8e50f28f0426eaa20c84unaffected
pkg:github/heymrun/heym