Bug #17060
Updated by Jim Pingle 10 days ago
The TFTP package has a *Files* tab at @tftp_files.php@ that allows administrators to manage files available to TFTP clients. Among other features, this page allows administrators to download or delete files by passing a path and filename. The package contains an incomplete boundary check that fails to properly restrict the download and delete actions to the TFTP server file directory at @/tftpboot@. As a consequence, users with access to this page can use directory traversal techniques to download or delete arbitrary files on the device. Reported by: Rafael Honorato (@honorato0)