Embed Notice

HTML Code

<blockquote style="position: relative; padding-left: 55px;"><section><a href="https://ryona.agency/objects/39599fd7-1307-4c9c-89d5-b6ebdb3939ee"> (mint@ryona.agency)'s status on Thursday, 02-Mar-2023 19:01:48 JST</a><a href="https://ryona.agency/users/mint" title="mint@ryona.agency"><img src="https://gnusocial.jp/avatar/1002-48-20220724171046.webp" width="48" height="48" alt="" style="position: absolute; left: 0; top: 0;"></a><div><a href="https://xn--p1abe3d.xn--80asehdb/objects/6532558a-e454-4b7b-991d-3f322cf31418" rel="in-reply-to">in reply to</a><ul><li><li><a href="https://gnusocial.jp/user/3409" title="bot@seal.cafe">Fediverse Contractor</a></li><li><a href="https://gnusocial.jp/user/101145" title="pedophilesoftwareinc@cum.salon">:SOGG: ing</a></li></ul></div></section><article><a href="https://xn--p1abe3d.xn--80asehdb/users/pomstan">@pomstan</a> <a href="https://cum.salon/users/pedophilesoftwareinc">@pedophilesoftwareinc</a> <a href="https://seal.cafe/users/bot">@bot</a> No screening for ../ paths in uploader, apparently. Still not sure how it can be exploited since pleromer saves images with their hash instead of filename by default.</article><footer><a rel="bookmark" href="https://gnusocial.jp/conversation/1268147#notice-2662326">In conversation</a><time datetime="2023-03-02T19:01:48+09:00" title="Thursday, 02-Mar-2023 19:01:48 JST">Thursday, 02-Mar-2023 19:01:48 JST</time> <span>from <span><a href="https://ryona.agency/objects/39599fd7-1307-4c9c-89d5-b6ebdb3939ee" rel="external" title="Sent from ryona.agency via ActivityPub">ryona.agency</a></span></span><a href="https://ryona.agency/objects/39599fd7-1307-4c9c-89d5-b6ebdb3939ee">permalink</a></footer></blockquote>

Corresponding Notice

Embed this notice
(mint@ryona.agency)'s status on Thursday, 02-Mar-2023 19:01:48 JST
in reply to
@pomstan @pedophilesoftwareinc @bot No screening for ../ paths in uploader, apparently. Still not sure how it can be exploited since pleromer saves images with their hash instead of filename by default.
In conversationThursday, 02-Mar-2023 19:01:48 JST from ryona.agencypermalink

Public

Embed Notice

HTML Code

Corresponding Notice