Bitwarden · Report #1206799
When uploading attachments, unencrypted file names are made available to the server
Validstatus
8upvotes
2 Aug 2021disclosed
Summary
Certain Bitwarden clients were inadvertently posting raw filenames to the server when saving new attachments. The server was discarding this value and properly storing the encrypted filename, however, a malicious server could glean some information from the filename if it were inclined. The issue has been patched.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.