🎯 New Report #3634571: Path Traversal in writeFile via Unsafe Prefix Containment Check Allows Out-of-Directory Writes
🔺Severity: Medium
👽 Reporter: tipsen
⭐️ Reputation: 909
🛠 State: resolved
💼 Team: arkadiyt-projects
💵 Bounty: null
🕐 Submitted: 2026-03-28
⏰ Disclosed: 2026-03-31 02:04:58
📝 Summary: A path traversal vulnerability was discovered in the protodump tool. The vulnerability allowed an attacker to influence the output filename construction and bypass the containment check, enabling writes outside the intended output directory. The vulnerability was caused by the use of descriptor-controlled paths in the output filename construction, along with an unsafe lexical prefix check for directory containment. This issue has been identified in the protodump tool.
📂 Report JSON File: 3634571
@hackeronereports