Selectel Storage Upload Security & Risk Analysis

The 'selectel-storage-upload' plugin v2.0.1 presents a mixed security posture. While it exhibits good practices such as using prepared statements for all SQL queries and has no recorded vulnerabilities or critical taint flows, several significant security concerns exist. The plugin exposes two AJAX handlers that lack any authentication or capability checks, creating a considerable attack surface. This means any authenticated user, regardless of their role, could potentially trigger these functions, which is a serious oversight. Additionally, the taint analysis indicates two flows with unsanitized paths, which, although not flagged as critical or high severity, still warrant attention as they could be exploited in conjunction with the unprotected AJAX endpoints. The absence of vulnerability history and specific code signals like dangerous functions might suggest a relatively stable codebase, but the identified unprotected entry points are a clear and present risk that overshadows these positive aspects.