Valve · Report #949361
Shell command injection in https://partner.steamgames.com/admin/game/publish/ via screenshot URL
Validstatus
criticalseverity
59upvotes
30 Jul 2024disclosed
Summary
Insufficient validation of parameters allowed injecting shell metacharacters into values used to construct a Bash command.
.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.