=============================================================================================================================================
| # Title     : Voyager 1.8.0 Arbitrary File Upload Leading to Potential Remote Code Execution                                              |
| # Author    : indoushka                                                                                                                   |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 145.0.2 (64 bits)                                                            |
| # Vendor    : https://github.com/thedevdojo/voyager                                                                                       |
=============================================================================================================================================

[+] Affected Component : TCG\Voyager\Http\Controllers\VoyagerController::upload()

[+] Affected Versions  : Voyager prior to hardening of upload validation

[+] Confirmed on default installations using:

public storage disk

storage:link enabled

Image upload via Rich Text Editor (TinyMCE)

[+] Vulnerability Type

Arbitrary File Upload

Insufficient MIME Validation

Trusting Client-Supplied File Extension

Potential Remote Code Execution (RCE)

[+] Description : The Voyager upload endpoint fails to properly validate uploaded image files. The application relies on:

guessClientExtension()

client-controlled original filename

extension-based allowlist

[+] An attacker with minimal privileges (any role allowed to upload images in a Rich Text Box) can upload a polyglot file masquerading as an image while embedding server-side executable code.
    Because the file is stored using the original extension and placed in a web-accessible directory, this can lead to arbitrary code execution under certain server configurations.

[+] Vulnerable Logic :

$ext = $file->guessClientExtension();

if (in_array($ext, ['jpeg', 'jpg', 'png', 'gif'])) {
    $image->encode($file->getClientOriginalExtension(), 75);
    Storage::disk(...)->put($fullPath, (string) $image, 'public');
}

[+] Issues :

guessClientExtension() is client-influenced

Original extension is reused during encoding

No signature-based image verification

Publicly accessible storage path

[+] POC :

[+] bypass logic only

Step 1 – Prepare a Polyglot Image

Create a file that: Starts with a valid image header (e.g. GIF/JPEG)

Contains non-executable marker content for verification

[+] Example :

GIF89a
<NON_EXECUTABLE_TEST_MARKER>

[+] Save as: test.php.gif

Note: No PHP code is required to demonstrate the flaw.

Step 2 – Upload via Voyager Editor

Login as any user with Rich Text Box upload permission

[+] Insert image via editor :

Upload test.php.gif

Step 3 – Observe Stored File

The file will be stored as:

/storage/{slug}/{date}/test.php.gif

[+] This confirms :

Extension preservation

Lack of enforced re-encoding

Client filename trust

Step 4 – Impact Confirmation

If server-side execution is enabled for misconfigured MIME handlers or future changes:

This upload path becomes a code execution primitive

Risk escalates from File Upload → RCE

[+] Impact

An attacker may:

Upload arbitrary files

Bypass intended image-only restriction

Potentially execute server-side code

Escalate privileges or compromise the application

[+] Mitigation :

Force server-side extension

$image->encode('jpg', 75);

Validate image via signature (magic bytes)

Reject mixed or double extensions

Store uploads outside web root

Enforce strict MIME validation

Add upload size & rate limits

Greetings to :=====================================================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
===================================================================================================