ownCloud · Report #87505

Full Path Disclosure

Validstatus

1upvotes

6 Jan 2016disclosed

How it was found

When I was trying to upload a html file as profile picture as a non admin user. then it popped up with a message containing full path . Like that "Could not obtain lock type 1 on "/opt/lampp/htdocs/owncloud/data/12/files/opt/lampp/htdocs/owncloud/data/12/cache/avatar_upload"."

Thanks.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original