Description

A vulnerability was determined in DTStack Taier 1.4.0. Affected by this issue is the function FileUtils.deleteDirectory of the file ClusterController.java of the component Cluster Creation. This manipulation of the argument clusterName causes path traversal. Remote exploitation of the attack is possible. Upgrading to version 1.5.0 can resolve this issue. Patch name: ec8c59c76aceb04ab3080543ab2d9c6a4b674729. The affected component should be upgraded.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.8",
  "pubDate": "2026-08-14T01:18:57.253Z",
  "pubdate": "2026-08-14T01:18:57.253Z",
  "executiveSummary": "A path traversal vulnerability has been identified in DTStack Taier version 1.4.0, specifically within the Cluster Creation component. The security defect resides in the FileUtils.deleteDirectory function located in the ClusterController.java file. An unauthenticated or remote attacker can exploit this vulnerability by manipulating the clusterName argument, allowing for unauthorized directory deletion outside of the intended scope.\nThe primary impact of this security flaw is the arbitrary deletion of directories on the underlying host filesystem via path traversal sequences (such as directory climbing characters). This remote exploitation vector poses significant risks to system integrity and data availability. The affected product is DTStack Taier version 1.4.0, and the issue is fully resolved by upgrading to version 1.5.0 using the official patch identified by the commit hash ec8c59c76aceb04ab3080543ab2d9c6a4b674729.",
  "technicalDetails": "The vulnerability is caused by insufficient input validation and sanitization of user-supplied data passed to file system operations. Specifically, the Cluster Creation component in DTStack Taier processes requests within ClusterController.java, where the clusterName parameter is accepted and subsequently handled by the FileUtils.deleteDirectory function.\nDuring the attack flow, a malicious actor crafts a remote request containing directory traversal sequences within the clusterName argument. Because the application fails to adequately canonicalize or restrict the input path to the designated base directory, the underlying Java file I/O operations resolve the manipulated path relative to the root or working directory of the application.\nWhen the FileUtils.deleteDirectory method executes, it processes the tainted path, resulting in the recursive deletion of targeted directories outside the intended operational boundaries. This requires network exposure to the DTStack Taier cluster creation endpoints and allows remote attackers to execute unauthorized file system deletion operations without requiring complex prior privileges, depending on the operational context of the running Java process.\nThe affected component is the Cluster Creation module, specifically within ClusterController.java referencing FileUtils.deleteDirectory. Affected versions are strictly limited to DTStack Taier 1.4.0. The vulnerability is successfully mitigated in version 1.5.0."
}