The CControl::Download function (/dl URI) in Winamp Web Interface (Wawi) 7.5.13 and earlier allows remote authenticated users to download arbitrary file types under the root via a trailing . (dot) in a filename in the file parameter, related to erroneous behavior of the IsWinampFile function.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Winamp_web_interface | Flippet.org | * | 7.5.13 (including) |
| Winamp_web_interface | Flippet.org | 7.5.9 (including) | 7.5.9 (including) |
| Winamp_web_interface | Flippet.org | 7.5.11 (including) | 7.5.11 (including) |