High Issues

When file-event hooks are turned on, the server pastes the name of the file a user just uploaded, renamed, or deleted directly into a command that runs on the server. A user who simply names their file with shell tricks can make the server run their own commands, even without permission to run commands.

Usernames are stored exactly as typed, but the folder for each user is named after a cleaned-up version of the username. Two different usernames can clean to the same folder name, so someone can register a look-alike name and end up sharing another person's private files.

Each user is meant to stay inside their own folder, but the confinement check only compares text, it does not resolve symbolic links. If a shortcut pointing outside the folder exists inside a user's area, the user can read or overwrite files anywhere the server can reach — including the app's database.

With the built-in default settings, anyone who signs up for an account is placed at the very top of the server's file tree instead of a private folder of their own. That gives every self-registered user permission to read, change, and delete all served files.

When a user deletes a file or folder, the app trusts the path text but does not check whether any folder along the way is a shortcut that points outside the user's allowed area. If such a shortcut exists, the delete can wipe out unrelated files elsewhere on the server, including the app's own login database.

When a user renames or moves a file, the app checks the path as plain text but doesn't verify that folders along the way are real folders rather than shortcuts pointing elsewhere. An attacker can use such a shortcut to pull a file from outside their allowed area into it and then download it, or push their files out.