psitransfer@2.4.2

psitransfer is a Simple open source self-hosted file sharing solution

Affected versions of this package are vulnerable to Directory Traversal through the Store.getFilename path resolution in the upload storage component. An attacker can escape the upload jail and read or overwrite files outside the intended upload directory by supplying crafted upload IDs or bucket names containing traversal sequences or malformed ++ segments. This can expose or corrupt files on the server and break upload handling for users relying on the file transfer service.

Workarounds

• Reject PATCH requests to /files/:uploadId unless the expected sidecar metadata already exists, so an attacker cannot create an attacker-controlled file through a malformed upload target.
• Avoid using a custom PSITRANSFER_UPLOAD_DIR whose basename prefixes a startup-loaded JavaScript file path under the application root, such as conf, to prevent a crafted upload from landing on config.<NODE_ENV>.js and being executed on restart.

Upgrade psitransfer to version 2.4.3 or higher.