Description

HotelDruid before 3.0.6 has insufficient file upload sanitation in the backup/restore function.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.6",
  "pubDate": "2026-09-14T05:16:57.437Z",
  "pubdate": "2026-09-14T05:16:57.437Z",
  "executiveSummary": "HotelDruid versions prior to 3.0.6 are susceptible to an arbitrary file upload vulnerability located within the backup/restore functionality.\nThis vulnerability stems from insufficient input validation and file sanitation mechanisms during the restoration process, allowing an attacker to bypass intended file restrictions.\nThe primary impact of this flaw is the potential for Remote Code Execution (RCE) on the underlying server, as an attacker can upload malicious scripts, such as web shells, into executable directories.\nSuccessful exploitation allows an unauthenticated or authenticated attacker with access to the backup/restore interface to gain unauthorized command execution, potentially leading to full system compromise, data exfiltration, or unauthorized modification of system resources.\nThe risk implication is critical, as it undermines the integrity and confidentiality of the entire application environment. Administrators are advised to update the software to version 3.0.6 or later immediately to mitigate this exposure.",
  "technicalDetails": "The vulnerability resides within the backup/restore module of HotelDruid, which is designed to process user-provided backup files. The root cause is a failure in the application's sanitization logic to adequately validate the file contents, extensions, or metadata during the restore operation.\nIn a standard attack scenario, the adversary interacts with the backup/restore interface. By supplying a crafted backup archive containing malicious files, the attacker exploits the lack of server-side checks on the uploaded content. Because the application processes these files without sufficient verification, it fails to prevent the traversal or placement of arbitrary files into the web-accessible directory structure.\nThe attack flow proceeds as follows: First, the attacker creates a malicious payload, typically a PHP web shell or similar executable script. Second, the attacker packages this payload into the expected backup archive format required by the application. Third, the attacker initiates the restore process through the vulnerable function. Finally, the server unpacks or extracts the archive into a location where the web server executes the payload.\nOnce the malicious script is stored in a directory accessible to the web server, the attacker can invoke it via a standard HTTP request to the file's path. This results in the execution of arbitrary commands with the privileges of the web server process (e.g., www-data).\nThis vulnerability does not necessitate complex exploitation techniques beyond the ability to interact with the restore interface. It allows for the bypass of security controls intended to limit file types, as the system treats the uploaded malicious file as a legitimate component of the backup restoration process.\nAffected systems include all HotelDruid versions prior to 3.0.6. The exploitation exposes the server to persistent threats, as the injected malicious files remain on the filesystem until manually removed, enabling long-term unauthorized access and the potential for lateral movement within the hosting environment."
}