Description

A vulnerability was determined in dromara lamp-cloud up to 5.10.0. This issue affects some unknown processing of the file FileChunkController.java of the component chunk-check endpoint. Executing a manipulation of the argument Name can lead to path traversal. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-14T01:18:56.680Z",
  "pubdate": "2026-08-14T01:18:56.680Z",
  "executiveSummary": "A path traversal vulnerability has been identified in dromara lamp-cloud up to version 5.10.0, specifically residing within the chunk-check endpoint processing logic of the FileChunkController.java file.\nThe vulnerability allows remote, unauthenticated attackers to manipulate the Name argument supplied to the affected component, leading to arbitrary path traversal conditions.\nSuccessful exploitation of this flaw can result in unauthorized file system access or manipulation depending on the application context and file handling permissions.\nThe risk implications are significant due to the remote attack vector and the public disclosure of a functional exploit.\nThe project maintainers have been notified via an issue report but have not yet provided an official response or remediation patch.\nDefenders must monitor affected systems for anomalous requests targeting the chunk-check endpoint and implement interim input sanitization controls where feasible.",
  "technicalDetails": "The vulnerability exists in dromara lamp-cloud up to 5.10.0 within the file FileChunkController.java, specifically handling requests to the chunk-check endpoint.\nThe root cause stems from insufficient validation and sanitization of user-supplied input passed via the Name argument during file chunk verification processing.\nAn attacker can exploit this flaw remotely by injecting directory traversal sequences (such as dot-dot-slash patterns) into the vulnerable Name parameter.\nThe attack flow begins when the client submits a maliciously crafted HTTP request targeting the chunk-check endpoint.\nBecause the application fails to properly restrict file path resolution to the intended storage directory, the underlying file system APIs process the manipulated path.\nThis allows the attacker to traverse outside the designated boundary limits of the storage repository.\nThe affected component is exposed over the network, requiring no prior authentication or privileged access to initiate the attack sequence.\nThe behavior of the payload directly facilitates unauthorized directory traversal, enabling the potential reading, writing, or referencing of files outside the designated scope.\nPost-exploitation impact includes potential exposure of sensitive system files, unauthorized data modification, or further compromise depending on how the application handles the resolved file paths.\nSince no official patch has been released by the vendor at this time, technical mitigations must rely on strict input filtering and network-level access controls."
}