Impact

Insufficient input validation allowed an directory traversal vulnerability. Any admin config and file readable by the app can be retrieved by the attacker. Furthermore, some files can also be moved or deleted

Patches

Patched version:
444ae8d

References

https://en.wikipedia.org/wiki/Directory_traversal_attack

For more information

If you have any questions or comments about this advisory:

• Open an issue in https://github.com/fossasia/susi_server
• Email us at support@susper.net