Psono Server CVE-2026-117469

Requires an authenticated Psono account that holds at least read-only (download) access to a specific file within a file repository, and the file-repository feature must be in use. The attacker then submits download-transfer credentials to the upload endpoint to obtain a signed upload URL for an attacker-selected object key. Limiting factors: authentication is required (PR:L, not unauthenticated); the attacker must already have read access to a target object; no user interaction is needed; and impact is bounded by the server's transfer size, chunk-count, and lifetime limits, which cap how much can be written or overwritten.

This is a moderate-severity, low-urgency issue rather than a top priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, base 5.4) describes a network-reachable but authenticated flaw (PR:L) with limited integrity and availability impact and no confidentiality loss - consistent with a missing-authorization bug (CWE-862) where an attacker with only read-only access to a file can misuse the upload endpoint. The signals are mutually consistent and point low: EPSS is 0.34% (27th percentile), there is no CISA KEV listing, and no public exploit is identified at time of analysis. The vuln.today decision label is 'this_month', i.e. a routine patch cadence, not act_now or emergency. The one caveat is that the vector states AV:N while exploitation requires an authenticated account that already holds read-only access to a target file in a file repository - network reachability is real, but a valid low-privilege credential and an existing shared/readable object are prerequisites, so real-world exploitability is narrower than AV:N alone implies.

An authenticated Psono user who has only read-only (download) access to a file in a file repository crafts a request that presents download-transfer credentials to the upload endpoint. Because the server does not enforce the transfer direction, the attacker receives a signed upload URL for an attacker-chosen object key and appends a chunk, letting them write to or overwrite the owner's repository object and consume storage. No public exploit code is identified at time of analysis; the trigger is described in the vendor advisory but not published as a working exploit.