| शीर्षक | diyhi bbs 6.8 Path Traversal |
|---|
| विवरण | In the bbs project, the file upload API /control/forum/manage?method=add contains the following issue:
When uploading an image by the API, the parameter dirName is used as the storage directory for the uploaded image and the lockFile. However, the legality of dirName is not validated, which allows to upload image to arbitrary path and the lockFile to be created to arbitrary directories.
Project Link: https://github.com/diyhi/bbs
Affected Version: 6.8
Affected API: /control/forum/manage?method=add
Code Location: /src/main/java/cms/web/action/template/ForumManageAction.java:171 |
|---|
| स्रोत | ⚠️ https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250618-01.md |
|---|
| उपयोगकर्ता | ShenxiuSecurity (UID 84374) |
|---|
| सबमिशन | 18/06/2025 08:02 AM (1 वर्ष पहले) |
|---|
| संयम | 20/06/2025 09:29 PM (3 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 313560 [diyhi bbs 6.8 API ForumManageAction.java add dirName निर्देशिका ट्रैवर्सल] |
|---|
| अंक | 20 |
|---|