CyberRota Analysis
AI-GeneratedThe Volmarg Personal Management System is vulnerable to a path traversal issue that permits authenticated attackers to access arbitrary files by manipulating the GET /public/get-file/{path} endpoint. This flaw allows attackers to read sensitive files on the server, as the path parameter is directly processed without proper validation against a designated base directory. Organizations using this system should prioritize remediation to prevent potential data exposure and ensure the security of sensitive information.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Volmarg Personal Management System contains a path traversal vulnerability that allows authenticated attackers to read arbitrary files by supplying absolute filesystem paths to the GET /public/get-file/{path} endpoint. The path route parameter is passed directly to file_get_contents() without canonicalization against a permitted base directory, enabling attackers to retrieve sensitive files accessible to the PHP-FPM worker process without using directory traversal sequences.