Eladmin Missing Authorization in Storage Handlers

Missing authorization in Eladmin through 2.7 allows a low-privileged authenticated user to bypass the storage:add permission and upload image-named files to /api/localStorage/pictures, resulting in unauthorized writes to server local storage and disclosure of absolute server paths. Publicly available exploit code exists, and the issue requires a valid low-privileged account with network access to the API; no user interaction or elevated privileges are needed. The CVSS 5.3 rating and independent assessment bound the impact to file write and path disclosure rather than remote code execution, and no CISA KEV data indicates active exploitation.

Missing authorization in the eladmin downloadS3Storage handler (GET /api/s3Storage/download/{id}) lets any authenticated user - regardless of storage privileges - retrieve stored object URLs, and publicly available exploit code enables sequential-ID enumeration to harvest URLs for uploaded objects. The assessed vector requires a valid eladmin session of any privilege level (PR:L), but no storage-specific permission; actual file-content exposure occurs only when the referenced S3 buckets are publicly readable, otherwise impact is limited to URL and metadata disclosure. Rated CVSS 5.3 with no confirmed active exploitation (no CISA KEV), the low-complexity enumeration path and the public PoC still make it a genuine information-disclosure risk for internet-facing deployments.