Arbitrary File Read and Delete Vulnerability Affects HGiga OAKlouds' Modules

CVE-2024-26261

What is CVE-2024-26261?

The file download functionality in specific modules of HGiga OAKlouds is vulnerable to unauthorized access due to an issue that allows for Arbitrary File Read and Delete operations. Attackers can exploit this vulnerability by crafting specific request parameters with file paths, enabling them to access sensitive files without the need for user authentication. Additionally, this vulnerability facilitates the deletion of the accessed files post-download, leading to potential data loss and privacy concerns for affected users.

References