A critical information disclosure vulnerability in the linx-server application allows unauthenticated remote attackers to access sensitive data, posing a severe risk to system confidentiality.

This flaw exists within the uploadRemote function found in upload.go, which fails to properly restrict access to sensitive file operations. The vulnerability is exploitable by an unauthenticated remote attacker with no user interaction required.

The exploitation of this vulnerability could lead to the unauthorized exposure of sensitive files or system data stored on the server. Given the CVSS score of 9.1, this is classified as a critical risk that could result in significant data breaches, loss of intellectual property, and potential regulatory non-compliance for organizations hosting the software.

Immediate Action: Administrators should immediately restrict network access to the linx-server instance or disable the vulnerable upload functionality until a formal vendor patch is applied.

Proactive Monitoring: Review web server access logs for anomalous requests directed at the upload endpoint, specifically monitoring for unusual patterns or unexpected POST requests to the uploadRemote function.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block unauthorized requests targeting the upload.go file, providing a virtual patch until the underlying code is remediated.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the vulnerability report linked by the CVE record.

Due to the critical severity and the existence of a public proof-of-concept, organizations running linx-server must treat this as a high priority. We recommend isolating affected instances from public-facing networks immediately and applying the upstream fix commit 9a5fc11dffe5d2ac6cb6e7edfa97bccd417285ed if a vendor-provided update is not yet available.