File Transfer Vulnerability in Psono Server by esaqa

CVE-2026-117469

What is CVE-2026-117469?

The vulnerability in Psono Server versions 1.0.0 through 7.2.3 arises from a lack of enforcement on the direction of file-transfer credentials during file-repository operations. An authenticated remote attacker with read-only access can exploit this flaw to present a download transfer to the upload endpoint. This results in the attacker obtaining a signed upload URL for a chosen object key, allowing them to append chunks to a legitimate owner’s file. Consequently, this could lead to unauthorized uploads or overwrites of repository objects, thus leading to potential data loss and increased storage consumption, contingent on the limits set for transfer size, chunk count, and lifetime.

References