GHSA-jg7j-q6m4-7gq5: Authorization flaw in Psono Server file-repository operations

Psono Server CE and EE versions 1.0.0 through 7.2.3 did not enforce the direction of file-transfer credentials on file-repository operations. An authenticated remote attacker with read-only access to a file could use a download transfer at the upload endpoint and obtain a signed upload URL for an attacker-selected object key. This allowed data to be appended to the owner's file, repository objects to be uploaded or overwritten, and storage to be consumed.