Multiple relative path traversal vulnerabilities in the oneup/uploader-bundle before 1.9.3 and 2.1.5 allow remote attackers to upload, copy, and modify files on the filesystem (potentially leading to arbitrary code execution) via the (1) filename parameter to BlueimpController.php; the (2) dzchunkindex, (3) dzuuid, or (4) filename parameter to DropzoneController.php; the (5) qqpartindex, (6) qqfilename, or (7) qquuid parameter to FineUploaderController.php; the (8) x-file-id or (9) x-file-name parameter to MooUploadController.php; or the (10) name or (11) chunk parameter to PluploadController.php. This is fixed in versions 1.9.3 and 2.1.5.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| oneup/uploader-bundle(Packagist) | 2.0.0 | 2.1.5 | N/A |
| oneup/uploader-bundle(Packagist) | 1.0.0 | 1.9.3 | N/A |
CVSS Metrics
