| शीर्षक | ujcms 101.2 Recursive Deletion of Template Storage |
|---|
| विवरण | A logical vulnerability exists in the WebFileTemplateController.delete method. While the application implements a blacklist mechanism (checkId) to prevent standard path traversal (e.g., filtering .. and \), it fails to validate "empty" or "root-equivalent" inputs.
An attacker can bypass the validation by sending a specially crafted payload (such as an empty string "" or a single forward slash /). When processed, this input resolves to the root of the configured template storage directory. The deleteDirectory function then recursively deletes all files and subdirectories within this root, effectively wiping out the website's templates, styles, and scripts. |
|---|
| स्रोत | ⚠️ https://www.yuque.com/la12138/pa2fpb/lxngf3d07uyd0nwp?singleDoc |
|---|
| उपयोगकर्ता | Saul1213 (UID 94577) |
|---|
| सबमिशन | 10/02/2026 08:54 AM (8 महीनों पहले) |
|---|
| संयम | 21/02/2026 10:11 PM (12 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 347319 [Dromara UJCMS 101.2 Template WebFileTemplateController.delete deleteDirectory निर्देशिका ट्रैवर्सल] |
|---|
| अंक | 20 |
|---|