DPAttachments (com_dpattachments) below 5.8.1 - Unauthenticated Attachment Download, Stored XSS and Path Traversal
DPAttachments before 5.8.1 exposes every attachment to anyone who can guess an id. The front-end download route (index.php?option=com_dpattachments&task=attachment.download&id=N) confirmed only that an attachment record existed and never checked whether the requester was entitled to it, so unpublished attachments, attachments on a restricted view level, and attachments outside their publish window were all downloadable with no login. Attachment ids are sequential integers. The same gap was present on the attachment detail view. 5.8.1 adds a canView() check enforcing edit permission, published state, view access level and the publish up/down window on both paths. The release also fixes a stored cross-site scripting flaw in the CSV preview, where the header row was written out unescaped while the data cells were already escaped, and adds validation of the upload context string, which was used to build a filesystem path and could be tampered with to traverse outside it. Update to 5.8.1. No CVE has been assigned at the time of writing; the vendor rates the download flaw High.
Affected versions: < 5.8.1
Full advisory: our disclosure post
