CVE-2026-117469 Details
Description
Psono Server (CE & EE) versions 1.0.0 through 7.2.3 did not enforce the direction of file-transfer credentials on file-repository operations. An authenticated remote attacker with read-only access to a file could present a download transfer to the upload endpoint, obtain a signed upload URL for an attacker-selected object key, and append a chunk to the owner's file. Exploitation could upload or overwrite repository objects and consume storage, subject to transfer size, chunk-count, and lifetime limits.
A vulnerability exists in Psono Server (CE & EE) versions 1.0.0 through 7.2.3, where the direction of file-transfer credentials was not properly enforced during file-repository operations. This flaw allows an authenticated remote attacker with read-only access to a file to exploit the upload endpoint by presenting a download transfer. The attacker can then obtain a signed upload URL for a chosen object key and append a chunk to the owner's file. This exploitation could lead to unauthorized uploading or overwriting of repository objects, consumption of storage, and bypassing of file-transfer type restrictions, depending on the size of the transfer, the number of chunks, and the lifetime limits of the upload.
Users can update to Psono Server version 7.2.4, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 27, 2026CISA-ADP
Assessed Nov 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gitlab.com/esaqa/esaqa/security-advisories/-/blob/master/advisories/CVE-2026-117469.md | fdf66990-8419-4c8c-8848-ec15d75773b4 | AdvisoryVendor |
| https://gitlab.com/esaqa/psono/psono-server | fdf66990-8419-4c8c-8848-ec15d75773b4 | Vendor |
| https://gitlab.com/esaqa/psono/psono-server/-/blob/v7.2.3/psono/restapi/serializers/file_repository_upload.py | fdf66990-8419-4c8c-8848-ec15d75773b4 | Source CodeVendor |
| https://gitlab.com/esaqa/psono/psono-server/-/commit/64753b19bd8d03cfbed20db575f4dccb220d9ca4 | fdf66990-8419-4c8c-8848-ec15d75773b4 | Source CodeVendor |
| https://gitlab.com/esaqa/psono/psono-server/-/releases/v7.2.4 | fdf66990-8419-4c8c-8848-ec15d75773b4 | Release NotesVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | fdf66990-8419-4c8c-8848-ec15d75773b4 |
Affected Products
| Product | Versions |
|---|---|
| Psono Server | >= 1.0.0, <= 7.2.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 4, 2026 | CVE Modified | CISA-ADP |
| Oct 27, 2026 | New CVE Received | fdf66990-8419-4c8c-8848-ec15d75773b4 |