Skip to content
Breaking Tenant Boundaries, When Path Traversal Isn't About the Filesystem
labs.cognisys.group | blog | #data-exposure | #path-traversal | #saas | #ssrf | #cross-tenant | #multi-tenant
Summary
A multi-tenant SaaS case study where an apparent dead-end path traversal actually targeted an internal API URL, letting any authenticated user download every tenant's asset-library files.
- Published
- Collected