Executive brief
Volmarg Personal Management System is a personal data and file management application. An authenticated user can bypass path restrictions on the file download endpoint to read any file accessible to the web server process, such as configuration files containing database credentials or other sensitive data.
Technical details
The GET /public/get-file/{path} endpoint passes the path parameter directly to file_get_contents() without proper validation. Although the application intended to restrict file access to specific directories, the validation logic used str_contains() which checked only if the directory name appeared anywhere in the path, not that the path started with an allowed directory. An authenticated attacker can supply absolute filesystem paths or paths containing the allowed directory name in the middle to escape the intended base directory and retrieve arbitrary files. The vulnerability requires authentication but is otherwise trivial to exploit. The fix involves replacing str_contains() with str_starts_with() to properly enforce that file paths begin with an allowed directory.
Affected products
- Volmarg Personal Management System <unknown
Timeline
- 2026-08-27: disclosed
- 2026-08-27: patched: Fix applied in commit a044357 to use str_starts_with() instead of str_contains()