| शीर्षक | yangzongzhuan RuoYi-Vue <=3.9.2 Path Traversal |
|---|
| विवरण | The /common/download and /common/download/resource endpoints accept a user-controlled filename and guard it with FileUtils.checkAllowDownload, which only rejects the literal .. substring and enforces an extension allowlist. It does not canonicalize the path, reject absolute paths, or confine the result to the intended base directory. An authenticated user can therefore supply an absolute path (no .. needed) ending in an allowed extension to read or delete arbitrary files on the host — for example /etc/... or any *.zip/*.png/etc. anywhere on the filesystem. |
|---|
| स्रोत | ⚠️ https://github.com/yangzongzhuan/RuoYi-Vue/issues/151 |
|---|
| उपयोगकर्ता | Ana10gy (UID 93358) |
|---|
| सबमिशन | 02/07/2026 11:33 AM (2 महीनों पहले) |
|---|
| संयम | 19/08/2026 03:55 PM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 393040 [yangzongzhuan RuoYi-Vue तक 3.9.2 Common Download Endpoint CommonController.java fileDownload/resourceDownload fileName/resource निर्देशिका ट्रैवर्सल] |
|---|
| अंक | 20 |
|---|