Technical impact
NavigaTUM contains a path traversal flaw in the propose_edits endpoint that accepts file keys from JSON payloads without sanitization. By including traversal sequences such as "../../", an unauthenticated attacker can escape the intended temporary directory and overwrite existing files in directories writable by the application user, such as /cdn. This allows modification of public images or the placement of arbitrary data on the server, potentially leading to site defacement or denial of service via storage exhaustion.
Affected Systems
The vulnerability exists in all versions of TUM-Dev: NavigaTUM released before commit 86f34c7. The affected product is the NavigaTUM website and API, which allows room and place searches. No specific version numbers are listed beyond the commit identifier, indicating that any deployment not updated to or beyond that commit is susceptible.
Risk and Exploitability
The CVSS score of 8.8 classifies the flaw as high severity, although the EPSS score of less than 1% suggests a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires only a crafted HTTP request to the propose_edits endpoint; no authentication is needed. Attackers can overwrite arbitrary files in directories with write access, enabling defacement, data corruption, or the placement of malicious files if executable permissions are granted to the target area. The risk remains significant until the patch is applied, but the likelihood of a widespread attack at present is low.
