Path Traversal via 'Upload-Key' in SmartEMS Upload Handling

The primary impact of this vulnerability is the potential for arbitrary file write. By crafting malicious 'Upload-Key' headers containing path traversal sequences (e.g., '../..'), an attacker can bypass intended file storage restrictions. Successful exploitation could allow an attacker to overwrite critical system files, inject malicious code, or gain unauthorized access to sensitive data. While the description mentions 'remote code execution' as a potential outcome, this would likely require further exploitation of the written files, depending on the server configuration and file permissions. The blast radius extends to any system running the vulnerable SmartEMS Web Application, particularly those with publicly accessible upload endpoints.

Organizations using SmartEMS Web Application in environments where file uploads are a core functionality are at risk. This includes deployments with limited access controls or those running older, unpatched versions of the application. Shared hosting environments utilizing SmartEMS are particularly vulnerable due to the potential for cross-tenant exploitation.

• linux / server: Monitor web server access logs for requests containing suspicious characters in the 'Upload-Key' header (e.g., '../', '\\').

grep -i '..\|\\' /var/log/apache2/access.log

• generic web: Use curl to test the upload endpoint with crafted headers containing path traversal sequences and observe the server's response.

curl -H "Upload-Key: ../../../etc/passwd" http://<target>/upload

• other: Review the application's code for any instances where the 'Upload-Key' header is used without proper validation. Look for file creation or modification operations based on user-supplied input.

1. 2025-09-10Disclosure

   disclosure

1. Reserviert2025-04-16
2. Veröffentlicht2025-09-10
3. EPSS aktualisiert2026-03-23

The recommended mitigation is to immediately upgrade to version 3.3.6 or later, which contains the fix for this vulnerability. If upgrading is not immediately feasible, consider implementing temporary workarounds. These may include strict input validation on the 'Upload-Key' header, limiting the allowed characters and preventing path traversal sequences. Web Application Firewalls (WAFs) can be configured to block requests containing suspicious patterns in the 'Upload-Key' header. Regularly review file permissions and ensure that the upload directory is not writable by the web server user.