| 제목 | yeqifu warehouse aaf29962ba407d22d991781de28796ee7b4670e4 Arbitrary File Read |
|---|
| 설명 | An arbitrary file read vulnerability was discovered in AppFileUtils.java of the project https://github.com/yeqifu/warehouse. The affected functionality is an image display route (/file/showImageByPath?path=)that invokes AppFileUtils.java and accepts a user-controlled path parameter to locate files under a specified directory. Due to improper input validation, the path parameter is directly used to read files without verifying its legitimacy. By manipulating the path parameter with relative path sequences, an attacker can access, download, or view arbitrary files on the server. |
|---|
| 원천 | ⚠️ https://github.com/5i1encee/Vul/blob/main/Arbitrary%20File%20Read%20Vulnerability%20in%20Project%20yeqifu%20warehouse.md |
|---|
| 사용자 | 5i1encee (UID 94076) |
|---|
| 제출 | 2026. 01. 02. AM 11:33 (7 개월 ago) |
|---|
| 모더레이션 | 2026. 01. 02. PM 01:32 (2 hours later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 339385 [yeqifu warehouse 까지 aaf29962ba407d22d991781de28796ee7b4670e4 AppFileUtils.java createResponseEntity path 디렉토리 순회] |
|---|
| 포인트들 | 20 |
|---|