Directory Traversal Vulnerability in Seagate Media Server

CVE-2017-18263

What is CVE-2017-18263?

The Seagate Media Server in Seagate Personal Cloud before version 4.3.18.4 contains a directory traversal vulnerability in the 'getPhotoPlaylistPhotos.psp' file handler. This flaw allows an attacker to exploit a parameter named 'url' to gain unauthorized access to sensitive files and directories on the server. By manipulating this parameter, an attacker can traverse the filesystem, potentially exposing confidential information stored on the server.

References