Description

Volmarg Personal Management System contains a path traversal vulnerability that allows authenticated attackers to read arbitrary files by supplying absolute filesystem paths to the GET /public/get-file/{path} endpoint. The path route parameter is passed directly to file_get_contents() without canonicalization against a permitted base directory, enabling attackers to retrieve sensitive files accessible to the PHP-FPM worker process without using directory traversal sequences.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-27T17:18:22.833Z",
  "pubdate": "2026-08-27T17:18:22.833Z",
  "executiveSummary": "The Volmarg Personal Management System contains a critical path traversal vulnerability within its file retrieval mechanism. This vulnerability exists in the GET /public/get-file/{path} endpoint, which fails to properly sanitize or validate user-supplied file paths.\nAn authenticated attacker can exploit this flaw to read arbitrary files from the underlying filesystem that the PHP-FPM worker process has read permissions for. Because the application does not enforce base directory constraints or canonicalize input paths, an attacker can bypass intended access controls to retrieve sensitive configuration files, environment variables, or system credentials.\nThe vulnerability requires authenticated access, but once the session is established, it permits unauthorized read access to the server's filesystem. This poses a significant risk to confidentiality, potentially leading to full system compromise if sensitive credentials or cryptographic keys are exfiltrated.\nThere are no requirements for complex directory traversal sequences, as the application accepts absolute paths directly. The risk is considered high due to the ease of exploitation and the potential for exfiltrating critical backend infrastructure data.",
  "technicalDetails": "The vulnerability resides in the request handler associated with the /public/get-file/{path} route. The root cause is the insecure implementation of the file retrieval function, which passes the user-supplied {path} parameter directly into the PHP file_get_contents() function without implementing a restrictive chroot-like mechanism or performing path canonicalization.\nIn a secure implementation, an application would resolve the requested path against a predefined document root, verify that the resulting path remains within the intended directory, and sanitize the input to prevent access to sensitive system files. In this instance, the application fails to validate whether the provided path resolves to an authorized directory.\nThe attack flow begins when an authenticated attacker submits a crafted HTTP GET request to the /public/get-file/{path} endpoint. Instead of providing a filename expected by the application, the attacker provides an absolute filesystem path—for example, /etc/passwd or /var/www/html/.env. The application backend receives this input and invokes file_get_contents() with the attacker-supplied string. Because the PHP-FPM process typically operates with specific service account permissions, it reads the content of the targeted file and returns it directly in the HTTP response body.\nThe exploit does not require the use of traditional dot-dot-slash (../) traversal sequences, as the backend accepts absolute paths. This significantly simplifies the exploitation process for the attacker, as they are not restricted by the current working directory of the application.\nThe post-exploitation impact is severe. An attacker can systematically enumerate and exfiltrate files that are readable by the web server user. This often includes /etc/passwd (for user enumeration), application source code (which may reveal hardcoded database credentials or API keys), configuration files (containing database connection strings or secret keys), and private SSH keys if the web server process has misconfigured file permissions. This level of access typically provides the attacker with sufficient information to escalate privileges, pivot within the network, or compromise the underlying database system."
}