🎯 New Report #3506873: Shared smart albums in the Photos app can expose files outside the album owner's configured source folders
🔺Severity: Medium
👽 Reporter: suul
⭐️ Reputation: 1727
🛠 State: resolved
💼 Team: Nextcloud
💵 Bounty: null
🕐 Submitted: 2026-01-11
⏰ Disclosed: 2026-09-17 10:48:18
📝 Summary: A vulnerability was discovered in a file manager component of a file sharing application. The vulnerability allowed an attacker to access files outside of the intended shared folder by configuring more permissive search paths than the victim intended. This resulted in unauthorized information disclosure, as the system used the attacker's configuration to determine the search scope in the victim's folder. The vulnerability was caused by insufficient validation of the search paths provided by the attacker.
📂 Report JSON File: 3506873
@hackeronereports