🔺Severity: Low
👽 Reporter: r1skr1der
⭐️ Reputation: 430
🛠 State: resolved
💼 Team: 8x8
💵 Bounty: 100
🕐 Submitted: 2026-01-03
⏰ Disclosed: 2026-07-02 15:41:33
📝 Summary: A path traversal vulnerability was discovered in the
/api/v1/uploads/analyze endpoint of the jitsi-call-analytics backend. The vulnerability allowed unauthenticated users to write files within the configured RTCSTATS DOWNLOADS PATH directory. The issue was caused by the upload handler using user-controlled file.originalname directly in path.join() without sanitization, enabling attackers to include ../ sequences to escape the intended per-session UUID directory and write or overwrite files anywhere under the configured root path. The vulnerability was addressed by fixing the security issue in the file upload handler.📂 Report JSON File: 3485343
@hackeronereports