CyberRota Analysis
AI-GeneratedAuthenticated users of admin3 versions up to 3.0.0 on Windows are vulnerable due to inadequate sanitization of client-supplied filenames in the upload handler, allowing for directory traversal attacks. This flaw enables attackers to exploit dot-dot path segments to write files outside the designated storage root, potentially overwriting critical server files. Organizations using affected versions should prioritize patching this vulnerability to mitigate the risk of unauthorized file access and potential system compromise.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
admin3 through 3.0.0 fails to sanitize client-supplied filenames in the upload handler, allowing authenticated users to write files outside the storage root on Windows deployments. Attackers can use dot-dot path segments in filenames to escape the configured storage directory and overwrite arbitrary files accessible to the server process.