Description

A vulnerability was detected in Jevon-Zhong Ai-doctor 0.0.1. This vulnerability affects the function deleteImage of the file ai-doctor-server/src/filemanagement/filemanagement.service.ts. Performing a manipulation of the argument imagePath results in path traversal. The attack must be initiated from a local position. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.4",
  "pubDate": "2026-08-09T03:16:56.873Z",
  "pubdate": "2026-08-09T03:16:56.873Z",
  "executiveSummary": "A path traversal vulnerability has been identified in the Jevon-Zhong Ai-doctor application, specifically within version 0.0.1. The flaw resides in the deleteImage function located in the ai-doctor-server/src/filemanagement/filemanagement.service.ts file. By manipulating the imagePath argument, an attacker can bypass intended directory boundaries and interact with arbitrary files on the underlying filesystem.\nThe primary risk associated with this vulnerability is unauthorized file deletion or manipulation, depending on the permissions of the underlying service account. The impact directly affects the integrity and availability of the host system. Exploitation of this vulnerability requires local access to the target environment and assumes the attacker possesses the capability to invoke the vulnerable function or interface with the server-side logic.\nThe project maintainers were notified of this security issue via an early issue report but have not yet provided an official response or patched release. Consequently, systems running the affected version remain exposed to potential local exploitation until administrative hardening or source code modifications are implemented.",
  "technicalDetails": "The vulnerability stems from insufficient input sanitization and validation within the file management service of the Jevon-Zhong Ai-doctor platform. Specifically, the deleteImage function processes the imagePath argument supplied to ai-doctor-server/src/filemanagement/filemanagement.service.ts without properly neutralizing directory traversal sequences such as dot-dot-slash (../).\nThe root cause is the direct concatenation or utilization of user-supplied path parameters in filesystem APIs without enforcing a strict root directory constraint or resolving absolute paths against a secure base directory. Because the application blindly trusts the input provided to the imagePath parameter, an attacker can supply sequences designed to navigate upward through the directory tree.\nThe attack flow proceeds as follows: First, the attacker identifies or gains local access to an execution context or interface capable of invoking the deleteImage function with a controlled imagePath argument. Second, the attacker crafts a malicious payload containing relative path traversal sequences (e.g., ../../sensitive/file/path). Third, the input is passed directly into the vulnerable service without adequate validation. Finally, the file system operation executes the deletion or interaction against the resolved target path outside the intended storage directory.\nRegarding authentication and exposure requirements, the attack must be initiated from a local position. The network exposure is constrained by the local execution requirement, and specific privilege requirements depend on the operating system permissions assigned to the running Node.js process hosting the Ai-doctor server. If the process executes with elevated privileges, the scope of accessible files increases significantly.\nPost-exploitation impact includes the unauthorized removal of critical system files, application binaries, or configuration data, leading to denial of service conditions or application instability. The vulnerability affects version 0.0.1 of the Jevon-Zhong Ai-doctor software package."
}