Description

A vulnerability was found in DTStack Taier 1.4.0. Affected by this vulnerability is the function Paths.ge of the file FileChunkController.java of the component Chunk-Check Endpoint. The manipulation of the argument Name results in path traversal. The attack may be launched remotely. The exploit has been made public and could be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-14T01:18:57.080Z",
  "pubdate": "2026-08-14T01:18:57.080Z",
  "executiveSummary": "A path traversal vulnerability has been identified in DTStack Taier version 1.4.0, specifically within the Chunk-Check Endpoint handled by the FileChunkController.java component. This security flaw stems from insufficient input validation and sanitization of the Name argument processed by the Paths.ge function. An unauthenticated remote attacker can exploit this vulnerability to traverse the directory structure of the underlying host system, leading to unauthorized file system access. The realization of this flaw poses significant risk implications, as public exploits are available, enabling malicious actors to leverage the weakness without advanced privileges. The potential impact includes the exposure of sensitive system files, configuration data, and application source code, thereby compromising the confidentiality and integrity of the hosting environment. Successful exploitation requires network connectivity to the vulnerable endpoint and does not necessitate prior authentication or complex attack prerequisites.",
  "technicalDetails": "The vulnerability resides in DTStack Taier 1.4.0 within the Chunk-Check Endpoint managed by the FileChunkController.java file. Specifically, the flaw originates in the Paths.ge function, which improperly handles user-supplied input provided via the Name argument. In typical path traversal vulnerabilities of this nature, the application accepts file or path identifiers directly from HTTP parameters without enforcing strict canonicalization checks or constraining operations to a designated safe base directory.\nThe root cause is the direct concatenation or utilization of untrusted input containing directory traversal sequences such as dot-dot-slash (../) within file system path resolution logic. When a remote client issues an HTTP request to the Chunk-Check Endpoint, the manipulated Name argument is passed into the vulnerable Paths.ge function. Because the application fails to neutralize directory navigation characters, the underlying Java runtime resolves the path outside the intended directory boundary.\nThe attack flow proceeds as follows: First, the remote attacker identifies the exposed Chunk-Check Endpoint associated with FileChunkController.java. Second, the attacker crafts an HTTP request containing a malicious payload within the Name argument, inserting sequence characters designed to navigate upward through the directory hierarchy. Third, the application processes the request, evaluating the path via the vulnerable function. Finally, the system attempts to access or check the existence of the targeted file outside the restricted scope, returning status information or facilitating further unauthorized file retrieval based on the application response.\nThe vulnerable component is exposed over the network, allowing remote exploitation without authentication or specific privilege requirements. The post-exploitation impact includes unauthorized read access to arbitrary files accessible to the application process, potentially exposing sensitive system credentials, application secrets, and operational data."
}