Security: critical vulnerability in file manager upload handler - requesting private contact

[kta1kri]

I found a critical security vulnerability in the file manager's upload handler that allows cross-tenant file writes (potential RCE against other customers' websites). There's no SECURITY.md or GitHub private vulnerability reporting on this repo, so I'm not posting technical details here.

I've emailed contact@crivion.com with the full write-up. If that's not the right address, could you point me to a private channel (email, GHSA collaborator invite, etc.)? Happy to wait for a fix before any detail becomes public.

[crivion]

Thanks for this, and for handling it the way you did — going straight to email, keeping details off a public issue, and offering to wait for a fix. That's exactly what we'd hope for, and it gave us room to do the work properly.

A fix is merged. It went in as #21, and the release is being cut now.

Your report was accurate. Auditing it also turned up a second, related class of the same problem that the original write-up didn't cover, so the fix is broader than the specific handler you identified — the containment now applies across every file manager operation rather than just the one path. Good report to have received.

You're credited by name in the GitHub Security Advisory, which will be published shortly after the release so people have a window to upgrade first. The full technical detail lives there rather than in this thread. If you'd prefer different wording for the credit, a different name, or no credit at all, say so and I'll change it.

You're also right about the process gap: there was no SECURITY.md and private vulnerability reporting wasn't enabled, which left you with no good way in. That's on us and is being sorted, so the next person doesn't have to open a public issue asking where to send things.

Leaving this open until the advisory is published, in case you want to follow up here. Thanks again.

[kta1kri]

Thanks for the detailed update, and for finding the second variant — containing it across every file manager operation rather than the single handler is the better fix.

Credit as kta1kri is right, with a link to https://github.com/kta1kri if you use links. No other name.

Happy to wait for the advisory.