Bugtracker Net
Monthly
Path traversal in the BugTracker.NET file download component allows an authenticated remote attacker to read files outside the intended download directory by supplying a manipulated filename parameter, exposing any file readable by the account running the web application. Exploitation requires a valid BugTracker.NET session (any account able to reach the download handler that accepts a user-supplied filename) and no user interaction; the blast radius is bounded by the operating-system permissions of the application's service account, so a hardened, least-privilege IIS identity materially limits the disclosure. The issue is rated 7.1 (CVSS 4.0) with high confidentiality impact and no integrity or availability effect, and there is no public exploit identified at time of analysis, though the low attack complexity and widespread wildcard CPE coverage make the class of bug attractive to post-authentication attackers who already hold a low-privileged account.
Authenticated attackers holding BugTracker.NET administrator privileges can achieve server-side code execution by first reconfiguring the application so that attachments are stored in a web-accessible directory, then uploading an .aspx file that the attachment feature fails to filter by extension. Because the uploaded file lands in a location the web server serves and ASP.NET/IIS will process executable handlers there, requesting its URL runs arbitrary code under the web service account. Exploitation is heavily gated: it requires PR:H administrator access and a non-default storage configuration (reflected as AT:P in the CVSS 4.0 vector), and no public exploit code has been identified at time of analysis; the signals consistently describe this as a low real-world priority issue despite a high CVSS 4.0 base score of 7.5.
Operating system command injection in BugTracker.NET's SVN integration lets an authenticated administrator store malicious arguments in the repository configuration field, which are later concatenated into an svn.exe command line and executed when the revision-comparison feature is invoked, yielding arbitrary command execution under the application service account's privileges. Exploitation requires a high-privileged (administrator) account, the optional SVN integration to be enabled, and svn.exe to be installed and invokable by the service account (AT:P in the vendor CVSS 4.0 vector), so the realistic attack surface is narrow despite the network vector. There is no public exploit identified at time of analysis, and this CVE is not listed in CISA KEV; the reported CVSS score is 7.5, though our independent assessment rates the practical risk lower given the layered prerequisites.
Path traversal in the BugTracker.NET file download component allows an authenticated remote attacker to read files outside the intended download directory by supplying a manipulated filename parameter, exposing any file readable by the account running the web application. Exploitation requires a valid BugTracker.NET session (any account able to reach the download handler that accepts a user-supplied filename) and no user interaction; the blast radius is bounded by the operating-system permissions of the application's service account, so a hardened, least-privilege IIS identity materially limits the disclosure. The issue is rated 7.1 (CVSS 4.0) with high confidentiality impact and no integrity or availability effect, and there is no public exploit identified at time of analysis, though the low attack complexity and widespread wildcard CPE coverage make the class of bug attractive to post-authentication attackers who already hold a low-privileged account.
Authenticated attackers holding BugTracker.NET administrator privileges can achieve server-side code execution by first reconfiguring the application so that attachments are stored in a web-accessible directory, then uploading an .aspx file that the attachment feature fails to filter by extension. Because the uploaded file lands in a location the web server serves and ASP.NET/IIS will process executable handlers there, requesting its URL runs arbitrary code under the web service account. Exploitation is heavily gated: it requires PR:H administrator access and a non-default storage configuration (reflected as AT:P in the CVSS 4.0 vector), and no public exploit code has been identified at time of analysis; the signals consistently describe this as a low real-world priority issue despite a high CVSS 4.0 base score of 7.5.
Operating system command injection in BugTracker.NET's SVN integration lets an authenticated administrator store malicious arguments in the repository configuration field, which are later concatenated into an svn.exe command line and executed when the revision-comparison feature is invoked, yielding arbitrary command execution under the application service account's privileges. Exploitation requires a high-privileged (administrator) account, the optional SVN integration to be enabled, and svn.exe to be installed and invokable by the service account (AT:P in the vendor CVSS 4.0 vector), so the realistic attack surface is narrow despite the network vector. There is no public exploit identified at time of analysis, and this CVE is not listed in CISA KEV; the reported CVSS score is 7.5, though our independent assessment rates the practical risk lower given the layered prerequisites.