← All KD5FMU repositories
freeloader
https://github.com/KD5FMU/freeloader
· Shell/PHP · 4 findings · Review date 2026-07-11
Executive Summary
4 finding(s) including 1 critical. Unauthenticated upload, list, and delete of arbitrary files on the Supermon web root.
<img width="1081" height="383" alt="image" src="https://github.com/user-attachments/assets/3ff2a9ea-8fb3-4c03-8a81-cf6816361514" />
Summary Counts
Quick Reference
| ID | Severity | Category | File | Lines | Finding |
|---|
| FREELOADER-001 |
Critical |
Security |
freeloader_upload.php |
66-103 |
Unauthenticated arbitrary file upload |
| FREELOADER-002 |
High |
Security |
freeloader_delete.php |
8-16 |
Unauthenticated file deletion |
| FREELOADER-003 |
High |
Security |
freeloader_upload.php |
13-59 |
Unauthenticated directory listing |
| FREELOADER-004 |
Medium |
Security |
freeloader_upload.php |
71-88 |
No file type validation on upload |
Critical Security Issues
[FREELOADER-001] Unauthenticated arbitrary file upload
freeloader_upload.php : 66-103
Upload handler accepts any file type up to 200 MB with no authentication or CSRF protection.
Impact: Anonymous users can write arbitrary files as www-data.
High Security Issues
[FREELOADER-002] Unauthenticated file deletion
freeloader_delete.php : 8-16
POST handler deletes any file in /my_uploads by basename with no authentication.
Impact: Anonymous users can delete uploaded files.
[FREELOADER-003] Unauthenticated directory listing
freeloader_upload.php : 13-59
GET ?action=list enumerates all files without authentication.
Impact: Exposes filenames and metadata to anyone.
Medium Issues
[FREELOADER-004] No file type validation on upload
freeloader_upload.php : 71-88
Accepts any extension and MIME with no allowlist.
Impact: Executable content may be uploaded to web-accessible directory.
Recommended Fix Priority
- Address all Critical findings before production deployment
- Require Supermon session authentication on all endpoints