漏洞描述 - Vulnerability Type: Path Traversal leading to Arbitrary File Deletion - Affected Versions: + ) - Issue: No canonicalization / allowlisting / boundary check is performed on filename. Inputs containing traversal sequences (e.g., ../../../../) can cause the resolved path to point outside userUploadsDir, enabling deletion of arbitrary files. PoC (概念验证) - Scenario: Deleting a file outside the uploads directory (example: /tmp/test inside Docker/container). - Steps: 1. Create a test file in the container/host environment. 2. Log in to obtain session cookies. 3. Trigger deletion via path traversal using a curl command. 影响 - Integrity impact: Deletion of application data, configuration, or other files. - Availability impact: Service disruption or permanent data loss. 漏洞严重程度 - Severity: High - CVSS v3 base metrics: - Attack vector: Network - Attack complexity: Low - Privileges required: Low - User interaction: None - Scope: Unchanged - Confidentiality: None - Integrity: High - Availability: High - CVE ID: CVE-2026-24741