{"id":"CVE-2026-117469","title":"File-transfer type confusion permits unauthorized repository writes in Psono Server","summary":"Psono Server (CE & EE) versions 1.0.0 through 7.2.3 did not enforce the direction of file-transfer credentials on file-repository operations. An authenticated remote attacker with read-only access to a file could present a download trans…","severity":"medium","cvss":5.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","cvssSource":"cna","cwe":["CWE-862"],"vendor":"esaqa GmbH","product":"Psono","affected":["Psono >= 1.0.0 < 7.2.4"],"published":"2026-10-27","updated":"2026-10-27","sourceUpdated":"2026-10-27T05:52:24.709Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-117469","references":[{"url":"https://gitlab.com/esaqa/esaqa/security-advisories/-/blob/master/advisories/CVE-2026-117469.md","label":"Vendor security advisory for CVE-2026-117469"},{"url":"https://gitlab.com/esaqa/psono/psono-server/-/blob/v7.2.3/psono/restapi/serializers/file_repository_upload.py"},{"url":"https://gitlab.com/esaqa/psono/psono-server/-/commit/64753b19bd8d03cfbed20db575f4dccb220d9ca4"},{"url":"https://gitlab.com/esaqa/psono/psono-server/-/releases/v7.2.4"},{"url":"https://gitlab.com/esaqa/psono/psono-server"}],"tags":["cve.org"],"epss":0.00337,"epssPercentile":0.26927,"ingestedAt":"2026-10-27T16:11:59.221Z","slug":"CVE-2026-117469","body":"## Overview\n\nPsono Server (CE & EE) versions 1.0.0 through 7.2.3 did not enforce the direction of file-transfer credentials on file-repository operations. An authenticated remote attacker with read-only access to a file could present a download transfer to the upload endpoint, obtain a signed upload URL for an attacker-selected object key, and append a chunk to the owner's file. Exploitation could upload or overwrite repository objects and consume storage, subject to transfer size, chunk-count, and lifetime limits.\n\n## Affected\n\n- `Psono >= 1.0.0 < 7.2.4`\n\n## Remediation\n\nUpgrade to Psono Server 7.2.4 or later.","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":29.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}