Description

An arbitrary file upload and path traversal vulnerability exists in LZ-litchi 1.0.0. Unauthenticated remote attackers can upload arbitrary files and write them outside the intended storage directory via the directory parameter in POST /app-api/infra/file/upload.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-09T22:18:19.043Z",
  "pubdate": "2026-09-09T22:18:19.043Z",
  "executiveSummary": "LZ-litchi version 1.0.0 is susceptible to an arbitrary file upload and path traversal vulnerability within its file management infrastructure.\nThis vulnerability is categorized as an improper neutralization of special elements used in a path (Path Traversal) combined with insecure file upload mechanisms.\nThe flaw exists within the /app-api/infra/file/upload endpoint, which fails to adequately sanitize user-supplied input contained within the directory parameter.\nAn unauthenticated remote attacker can exploit this flaw to bypass intended directory restrictions, effectively writing arbitrary files to unauthorized locations on the host filesystem.\nThe impact of this vulnerability is severe, potentially allowing for remote code execution (RCE) if an attacker can upload executable files (e.g., shell scripts, webshells) to web-accessible directories or configuration locations.\nSuccessful exploitation requires no prior authentication, exposing the application to significant risk from external threat actors.\nThe vulnerability highlights a critical failure in input validation for file handling processes, enabling attackers to gain persistence or compromise system integrity.",
  "technicalDetails": "The vulnerability resides in the /app-api/infra/file/upload endpoint of LZ-litchi 1.0.0, specifically within the logic processing the directory parameter during a multipart/form-data POST request.\nThe root cause is a lack of path normalization and restricted directory validation. The application accepts the directory parameter directly from the user without verifying that the resolved destination path resides within the authorized storage directory.\nAn attacker can craft a malicious HTTP request utilizing path traversal sequences (e.g., ../) within the directory parameter to escape the intended upload boundary.\nThe attack flow proceeds as follows: First, the attacker initiates a POST request to /app-api/infra/file/upload, including the target file in the request body and a manipulated directory parameter containing traversal sequences. Second, the application backend fails to sanitize these sequences, allowing the file writing operation to traverse outside the base directory. Third, the application proceeds to write the file content to the attacker-defined location on the host's underlying file system.\nBecause the application does not validate the file type or the destination path against a whitelist, attackers can upload malicious payloads. By traversing to web-accessible directories, the uploaded file may be executed by the web server, leading to full system compromise.\nThe vulnerability is accessible to unauthenticated users, meaning any remote actor with network connectivity to the application can initiate the upload process. No specific privileges are required to reach the vulnerable endpoint, as it is exposed through the application's public-facing API.\nPost-exploitation impact includes, but is not limited to, the deployment of webshells for persistent remote access, overwriting critical application configuration files to disrupt service, or accessing sensitive files stored elsewhere on the server that the web application user has permissions to read."
}