Arbitrary File Access Vulnerabilities in b3log Wide by b3log

CVE-2019-13915

What is CVE-2019-13915?

b3log Wide versions prior to 1.6.0 are susceptible to a series of attacks that enable unauthorized access to arbitrary files. Attackers can exploit the editor to write, compile, and execute code multiple times to read targeted files. Moreover, by creating symbolic links and embedding them within ZIP archives, attackers may manipulate the unarchive process to gain read and potentially write access based on file permissions. Additionally, importing Git repositories containing symlinks can facilitate similar access breaches, reflecting a significant security oversight in the application's handling of file permissions and symlink functionality.

References