The vulnerability allows an attacker to create an unlimited number of arbitrary folders in any location on the server, including the root directory. This can lead to resource exhaustion, denial of service (DoS), server unavailability, and potential data loss or corruption. The vulnerability is exploited by intercepting and modifying a specific HTTP POST request to include the desired folder location.

An attacker intercepts the HTTP POST request made when refreshing a conversation on the homepage. By modifying the request to specify a folder location, the attacker can create folders anywhere on the server. Repeating this process can lead to resource exhaustion and potentially bring down the server.

Any server running version 20240410 of the software is vulnerable. This includes administrators and users who rely on the server for critical services.