Critical · published November 11, 2024
🚨 An authenticated admin can wreak havoc by reading and deleting any file on the server! Sounds alarming, right? 🔥 Imagine a project manager who has the keys to the entire building and can open any office door — this vulnerability lets the admin access sensitive documents as easily as flipping through a file cabinet. With this vulnerability, an attacker could access private information or critical files, compromising both personal data and project integrity. The consequences could be absolutely devastating if sensitive files fall into the wrong hands, leading to data leaks or loss of important project work.
Imagine a project manager who has the keys to the entire building and can open any office door — this vulnerability lets the admin access sensitive documents as easily as flipping through a file cabinet. This vulnerability in Kanboard allows an authenticated admin to exploit a path traversal flaw by uploading a modified SQLite database. This enables them to access arbitrary files on the server, leveraging file attachments linked through the database.
With this vulnerability, an attacker could access private information or critical files, compromising both personal data and project integrity. The consequences could be absolutely devastating if sensitive files fall into the wrong hands, leading to data leaks or loss of important project work. Upgrade immediately to version 1.2.42 to patch this critical vulnerability. Review your current admin access levels and audit uploaded files to ensure no malicious databases have been introduced. There are no workarounds, so an update is essential! You've got this! Follow the steps and secure your Kanboard environment. 🛡️