HexBrain

Nextcloud · Report #696360

Exposing debug.log file leads to server full path disclosure

Validstatus
lowseverity
15upvotes
17 Oct 2019disclosed

How it was found

At the following address i have found debug.log file disclose the application full path on the server. https://nextcloud.com/wp-content/debug.log

Impact

The server should not expose this log file as it could help an attacker to understand the environment that may lead to further attacks.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original