Description

A vulnerability has been found in DTStack Taier 1.4.0. Affected is the function MultipartFile.getOriginalFilename of the file UploadController.java of the component Upload Controller. The manipulation of the argument File leads to path traversal. The attack may be initiated remotely. Upgrading to version 1.5.0 is able to address this issue. The identifier of the patch is 572773c4315e23e51e30115151cb091749a8d03e. It is advisable to upgrade the affected component.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.7",
  "pubDate": "2026-08-14T01:18:56.870Z",
  "pubdate": "2026-08-14T01:18:56.870Z",
  "executiveSummary": "A path traversal vulnerability has been identified in DTStack Taier version 1.4.0, specifically residing within the Upload Controller component.\nThe vulnerability stems from insecure handling of file names supplied via the MultipartFile.getOriginalFilename function in UploadController.java.\nRemote unauthenticated or authenticated attackers can manipulate the File argument to traverse directory structures and write arbitrary files to the underlying filesystem.\nSuccessful exploitation of this flaw can lead to arbitrary file write, potentially resulting in remote code execution, system compromise, or unauthorized access to sensitive application data.\nThe risk implications are critical due to the potential for complete system takeover via remote exploitation vectors.\nRemediation requires upgrading the affected component to version 1.5.0 or applying the official patch identified by hash 572773c4315e23e51e30115151cb091749a8d03e.",
  "technicalDetails": "The vulnerability is classified as a path traversal flaw caused by inadequate sanitization and validation of user-supplied input used in file system operations.\nThe vulnerable component is the Upload Controller within DTStack Taier 1.4.0, specifically located in the UploadController.java file.\nThe root cause of the vulnerability lies in the direct usage of the MultipartFile.getOriginalFilename method to derive the destination file path without stripping directory traversal sequences such as dot-dot-slash (../) characters.\nAttackers initiate the attack remotely by crafting a malicious HTTP multipart file upload request where the filename parameter of the File argument contains directory traversal patterns.\nDuring the attack flow, when the server processes the uploaded file via UploadController.java, it concatenates the unsanitized filename provided by MultipartFile.getOriginalFilename with the intended base storage directory path.\nBecause path separators and traversal sequences are not neutralized, the resulting absolute file path points outside the designated upload directory and onto arbitrary locations within the host file system.\nDepending on application execution permissions and file system ACLs, the payload behavior allows attackers to overwrite critical application binaries, configuration files, or place web shells into accessible web roots.\nThe post-exploitation impact includes complete loss of data integrity, potential remote code execution via web shell placement, and system compromise.\nNetwork exposure is fully remote, enabling external threat actors to target exposed instances of DTStack Taier 1.4.0."
}