| Package | Affected versions | Patched versions |
|---|---|---|
| mangadex-downloader | ≥ 1.3.0, < 1.7.2 | 1.7.2 |
| mangadex-downloader | ≥ 1.3.0, < 1.7.2 | 1.7.2 |
When using file:<location> command and <location> is web URL location (http, https). mangadex-downloader will try to open and read a file in local disk if the content from online file is exist-as-a-file in victim computer
So far, the app only read the files and not execute it. But still, when someone reading your files without you knowing, it's very scary.
https://www.mansuf.link/unauthorized-file-read-in-mangadex-downloader-cve-2022-36082/
Unfortunately, there is no workarounds to make it safe from this issue. But i suggest you double check the url before proceed to download or update to latest version ( >= 1.7.2)
Fixed in version 1.7.2. Commit patch: https://github.com/mansuf/mangadex-downloader/commit/439cc2825198ebc12b3310c95c39a8c7710c9b42
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free