CVE-2026-117469mediumCWE-862

CVE-2026-117469: falha de média gravidade em esaqa GmbH Psono

File-transfer type confusion permits unauthorized repository writes in Psono Server

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Psono

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.4epss 0.3%
Psono Server (CE & EE) versions 1.0.0 through 7.2.3 did not enforce the direction of file-transfer credentials on file-repository operations. An authenticated remote attacker with read-only access to a file could present a download transfer to the upload endpoint, obtain a signed upload URL for an attacker-selected object key, and append a chunk to the owner's file. Exploitation could upload or overwrite repository objects and consume storage, subject to transfer size, chunk-count, and lifetime limits.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Produtos afetados
esaqa GmbH · Psono
CVEs relacionadas — esaqa GmbH Psono

No mesmo produto, das mais perigosas para as menos.

CVE-2026-117468MEDIUMDevice-code claim permits restricted token escalation in Psono ServerEPSS 0.5%CVE-2026-117470MEDIUMWebAuthn assertion replay permits second-factor bypass in Psono ServerEPSS 0.4%CVE-2026-117472MEDIUMURL prefix handling permits API key read-scope bypass in Psono ServerEPSS 0.3%CVE-2026-117471MEDIUMUser-controlled Duo host permits authenticated SSRF in Psono ServerEPSS 0.2%