CVE-2023-33498: GitHub - YUyuanAN-com/loophole

Alist <=v3.16.3 Low privilege account arbitrary file upload Vulnerability.****Environmental deployment****First, Create a folder to hang in the desired folder

mount the local disk space on Alist

Then modify the permissions of the guest account so that it can modify the file name and create files

Start attack****Upload a file And modify the file name to “…/…/…/…/testfile”

test and verify****Check if there is a “testfile” file in the / directory