Executive brief
RosarioSIS is a student information system used by schools to manage grades, attendance, and student records. Versions before 12.9 allow authenticated users to delete critical application files—including stylesheets, configuration files, and other users' documents—by exploiting insufficient path validation in the file upload handlers. An attacker with any user account can bypass directory restrictions and remove system resources, potentially degrading or disabling the application.
Technical details
A path traversal vulnerability exists in the file deletion handlers within modules/Users/User.php and modules/Students/Student.php. The vulnerable code constructs a filesystem path by concatenating a user-controlled filename parameter directly without preventing directory traversal sequences (e.g., ../). Although the application performed extension whitelisting and realpath() checks after path construction, these controls did not reject traversal syntax itself, allowing an attacker to escape the intended upload directory. An authenticated user can craft a request with parent-directory sequences to delete files with allowed extensions throughout the application's filesystem scope, including CSS, JSON, XML resources and user documents. The issue was fixed in RosarioSIS 12.9 by explicitly rejecting ".." sequences and validating resolved paths against whitelisted storage directories.
Affected products
- François Jacquet RosarioSIS before 12.9
Timeline
- 2026-09-17: disclosed