Directory Traversal Vulnerability in Syncfusion EJ2 Node File Provider

CVE-2023-26563

What is CVE-2023-26563?

The Syncfusion EJ2 Node File Provider 0102271 is susceptible to a directory traversal vulnerability through the filesystem-server.js component. This flaw could enable an unauthenticated attacker to exploit the file management system on both Windows and Linux environments. On Windows, the attacker can list, read, delete, and upload files across any directory accessible by the web server. Similarly, on Linux, the attacker can read any file, download entire directories, delete files, and upload files with no authorization. This vulnerability poses serious risks to the integrity and confidentiality of sensitive files managed through this application.

References