Description
Invicti uploaded a ZIP file containing a symlink to /etc/passwd. It looks like that web application processed this file and returned the contents of /etc/passwd in response.
Remediation
The web application should filter symlinks included inside ZIP files.
References
Related Vulnerabilities
WordPress Plugin WordPress Backup to Dropbox Information Disclosure (4.7.1)
WordPress Plugin Credova_Financial Information Disclosure (1.4.8)
WordPress 5.7.x Multiple Vulnerabilities (5.7 - 5.7.7)
WordPress Plugin How to Create an App for Android iPhone Easytouch Arbitrary File Upload (3.0)
WordPress Plugin WP Activity Log Information Disclosure (3.1.1)