Description

Unauthenticated Local File Inclusion in Måne <= 1.7 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-24T12:16:53.730Z",
  "pubdate": "2026-08-24T12:16:53.730Z",
  "executiveSummary": "An unauthenticated Local File Inclusion (LFI) vulnerability has been identified in Måne versions 1.7 and below.\nThis vulnerability allows remote, unauthenticated attackers to traverse the file system and access arbitrary files residing on the host operating system.\nThe flaw exposes sensitive system configurations, application source code, and potentially sensitive credentials, posing a severe risk to the confidentiality and integrity of the underlying host.\nExploitation requires no prior authentication or specialized privileges, lowering the attack barrier for malicious actors capable of reaching the vulnerable application endpoint.\nThe root cause stems from improper input validation and sanitization of user-supplied parameters utilized in file retrieval operations.\nSuccessful exploitation allows unauthorized file retrieval across network boundaries without user interaction.",
  "technicalDetails": "The vulnerability resides within the file retrieval or rendering component of Måne versions 1.7 and below, where input supplied via HTTP requests is improperly sanitized before being passed to file system APIs.\nBecause the application fails to adequately validate or restrict paths, attackers can inject directory traversal sequences, such as dot-dot-slash (../) patterns, into the input parameter.\nThe attack flow proceeds as follows: 1) An unauthenticated attacker crafts an HTTP request targeting the vulnerable endpoint of the Måne application. 2) The crafted request embeds a relative or absolute path payload designed to traverse outside the intended web root directory. 3) The vulnerable component processes the unsanitized parameter and opens the targeted system file, such as /etc/passwd or application configuration files. 4) The application reads the contents of the requested file and returns them in the HTTP response body to the attacker.\nNetwork exposure is fully remote, as the vulnerable endpoint is accessible over the network without requiring authentication tokens or administrative privileges.\nThe post-exploitation impact includes the exposure of sensitive system files, cryptographic keys, and internal source code, which can facilitate further attacks such as remote code execution or complete system compromise."
}