Description

A vulnerability was found in Dromara lamp-cloud up to 5.10.0. This vulnerability affects unknown code of the file FileAnyoneController.java of the component File-Upload Controller. Performing a manipulation of the argument bucket/bizType results in path traversal. The attack can be initiated remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-14T01:18:53.793Z",
  "pubdate": "2026-08-14T01:18:53.793Z",
  "executiveSummary": "A path traversal vulnerability has been identified in Dromara lamp-cloud up to version 5.10.0, specifically within the file-upload controller component.\nThe flaw resides in the handling of user-supplied input passed to the bucket and bizType arguments within the FileAnyoneController.java file.\nSuccessful exploitation of this vulnerability allows remote attackers to manipulate file paths, potentially leading to unauthorized file system access or arbitrary file operations.\nThe vulnerability can be exploited remotely over the network without requiring prior authentication or specific elevated privileges, posing a significant risk to affected deployments.\nPublic exploits for this issue are currently available, and the vendor has not yet responded to early issue reports or released an official patch.\nOrganizations utilizing Dromara lamp-cloud up to version 5.10.0 should implement immediate compensatory controls to monitor and restrict suspicious file upload and storage requests.",
  "technicalDetails": "The vulnerability is classified as a path traversal flaw affecting the File-Upload Controller component of Dromara lamp-cloud up to version 5.10.0.\nThe root cause stems from the insecure processing of parameters associated with directory structures, specifically the bucket and bizType arguments processed by the FileAnyoneController.java file.\nWhen an application fails to properly sanitize, validate, or canonicalize user input that is subsequently used to construct file system paths or storage directory hierarchies, an attacker can inject directory traversal sequences such as dot-dot-slash (../) characters.\nThe attack flow begins with a remote, unauthenticated attacker crafting a malicious HTTP request targeting the vulnerable file upload or management endpoints handled by FileAnyoneController.java.\nBy injecting directory traversal payloads into the bucket or bizType parameters, the attacker forces the application to resolve file paths outside of the intended root directory context.\nBecause the network exposure is remote and the attack requires no privileges or authentication, external threat actors can easily script and automate exploitation attempts against exposed instances.\nPost-exploitation impact depends on the underlying file system permissions and application logic, but typically includes unauthorized directory traversal, potential exposure of sensitive system files, or arbitrary file placement within the host environment.\nSince public exploit code is already available, systems running vulnerable versions are at high risk of immediate compromise if exposed to untrusted networks."
}