Executive brief
pwnlift is a file upload server built with .NET and Blazor. When this software is run with administrative (root) privileges, a security flaw allows a local user to trick the system into writing files to restricted locations on the server, such as system configuration folders. This could allow an attacker to gain full control over the server or disrupt its operations.
Technical details
The vulnerability exists in the upload handler within Components/Pages/Home.razor. The application originally constructed its upload destination path using Directory.GetCurrentDirectory(), which can be influenced by a local attacker when the application is executed via sudo without a fixed working directory. An attacker can use symbolic links to redirect file uploads to sensitive system paths (CWE-59). While an initial fix attempted to check for reparse points, a Time-of-Check to Time-of-Use (TOCTOU) race condition (CWE-367) allowed attackers to swap a legitimate directory for a symlink between the check and the write operation. The final fix anchors the upload root to AppContext.BaseDirectory and improves path containment validation.
Affected products
- rasta-mouse pwnlift before d7a95449d9ee1ea09ec1529286685f6187afbbed
Timeline
- 2026-04-30: other: Vulnerability observed in lab environment
- 2026-05-07: disclosed: Initial contact with upstream maintainer
- 2026-05-12: patched: Initial remediation attempt (e3eddac)
- 2026-06-18: patched: Final fix merged (d7a9544)
- 2026-06-23: advisory: Public disclosure via oss-security and NVD