Enjin · Report #1081766
Unrestricted Upload of File with Dangerous Type
Validstatus
mediumseverity
20upvotes
20 Jan 2021disclosed
Summary
The security researcher was able to execute CWE-434: Unrestricted Upload of File with Dangerous Type through a legacy API endpoint used to upload images. This file was directly upload to our CDN with the appropriate MIME time of the file.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.