Read the researcher's report on HackerOne
The report describes a file-read issue affecting two VMware-related instances. Supplying a system file path as a query parameter reportedly caused its contents to be displayed; no code execution was demonstrated.
How it was found
- The researcher identified two VMware instance hosts.
- They tested a file-related endpoint with a system file path in its query parameter.
- The returned page reportedly showed the file contents.
- Access needed
- No account
- User interaction
- None
- Whose object
- No object involved
- Boundary crossed
- A public endpoint exposed a local file from the server filesystem.
- Root cause
- The endpoint appears to accept a user-controlled path and expose the referenced local file without adequate restriction.
- Impact
- An unauthenticated attacker could reportedly read sensitive server files, but remote code execution was only suggested as a possibility.
- Payload class
- Filesystem path
- Components
- file retrieval endpoint
- Confidence
- medium
Path traversalLocal file inclusionInformation disclosure
This analysis is CyberSIXT's own summary of the public report, written by a model and checked automatically. It may be wrong: the researcher's report is the source. Written 2026-11-15. Ask for a correction or removal.
| Report | Access | Whose object | Boundary crossed |
|---|---|---|---|
| [CVE-2022-44268] Arbitrary Remote Leak via ImageMagick | A user account | The attacker's own | An uploaded image caused the server-side image processor to disclose a local file in the returned image. |
| Grafana LFI on https://grafana.mariadb.org | No account | No object involved | An unauthenticated request purportedly crossed from a plugin resource path to a local system file. |
| Limited LFI | No account | No object involved | The page parameter traversed from the documentation directory into the parent project directory to read a README. |
| LFI with potential to RCE on ██████ using CVE-2019-3396 | Not clear from the report | No object involved | The preview feature is alleged to cross from remote input into local template-file access. |
| ssh: unprivileged users may hijack due to backdated ssh version open port found(███.unikrn.com) | No account | No object involved | No boundary crossing is demonstrated. |
| SMIL values and by attributes bypass remote image blocking via unvalidated resource-loading animations, enabling email tracking without consent | No account | No object involved | Email remote-resource blocking was bypassed, allowing the recipient’s client to contact an external server. |
| Payload delivery via Social Media urls on H1 profile | A user account | The attacker's own | A profile visitor was sent from a trusted profile button to an attacker-controlled download destination. |