📦 Pubnet

PubNet versions before 1.1.3 allow unauthenticated attackers to upload packages as any user by manipulating the author-id parameter in the /api/storage/upload endpoint. This enables identity spoofing,...