Description

Subscriber Path Traversal in Do Lasso <= 358 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-13T14:16:58.450Z",
  "pubdate": "2026-08-13T14:16:58.450Z",
  "executiveSummary": "A path traversal vulnerability has been identified in Do Lasso versions 358 and prior, specifically within the subscriber functionality.\nThis security flaw allows malicious actors to manipulate input paths, potentially leading to unauthorized access to sensitive files and directories residing outside the intended web root or application structure.\nThe vulnerability affects the Do Lasso product line up to version 358, creating significant risk implications regarding confidentiality and integrity of the underlying host operating system.\nExploitation of this flaw enables an attacker to retrieve arbitrary files accessible to the application process, depending on the privilege level of the running service.\nAttackers do not require complex prerequisites to leverage this vulnerability if the subscriber path parameters are exposed and improperly sanitized.",
  "technicalDetails": "The root cause of this vulnerability stems from insufficient input validation and sanitization of user-supplied path parameters within the subscriber component of Do Lasso <= 358.\nWhen an application fails to properly filter directory traversal sequences such as dot-dot-slash (../) from input streams utilized in file system operations, an attacker can traverse the directory tree.\nThe attack flow initiates when an adversary crafts a malicious HTTP request targeting the vulnerable subscriber functionality, embedding directory traversal patterns within the file retrieval or path resolution parameter.\nUpon receiving the payload, the vulnerable component processes the unsanitized input and passes it directly to the underlying file system APIs.\nThe application subsequently reads or includes the targeted file located outside the restricted directory and returns its contents in the response payload to the attacker.\nThe affected component is specifically the subscriber module within Do Lasso versions 358 and earlier.\nNetwork exposure is present if the application is accessible via the network, allowing remote attackers to dispatch crafted requests without prior authentication unless restricted by additional perimeter controls.\nPost-exploitation impact includes the unauthorized disclosure of configuration files, source code, system credentials, or other sensitive data accessible via the application's process context, potentially facilitating further system compromise."
}