Description

yx-image-recognition v1.0 is vulnerable to Path Traversal. Parameters such as dir, filePath are directly passed to new File() for file system operations without any path sanitization or whitelist validation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-26T22:16:29.327Z",
  "pubdate": "2026-08-26T22:16:29.327Z",
  "executiveSummary": "The application yx-image-recognition v1.0 is susceptible to a Path Traversal vulnerability, arising from improper handling of user-supplied input during file system operations.\nThe vulnerability occurs because the 'dir' and 'filePath' parameters are passed directly to the 'new File()' constructor without sanitization or validation.\nAn unauthenticated attacker can exploit this flaw to bypass intended directory restrictions, potentially accessing or manipulating arbitrary files on the underlying host operating system.\nThe impact includes unauthorized disclosure of sensitive configuration files, source code, or internal system data, depending on the process permissions of the application.\nThis vulnerability represents a significant security risk, as it allows for information disclosure and potentially facilitates further exploitation vectors such as Remote Code Execution (RCE) if sensitive files like SSH keys or configuration files are retrieved.",
  "technicalDetails": "The root cause of this vulnerability is the insecure use of user-controlled input in the instantiation of 'java.io.File' objects. The application fails to implement input validation or canonicalization, allowing attackers to supply path sequences such as '../' to escape the intended directory structure.\nWhen an application utilizes 'new File(input)', it trusts that the input string will be resolved within the designated application directory. However, by providing relative path traversal sequences, an attacker can navigate outside the application's root directory.\nThe attack flow begins when an attacker identifies the 'dir' or 'filePath' parameters within the request. By manipulating these parameters, the attacker submits payloads like '/etc/passwd' or '../../../etc/shadow'. Because the application performs no verification of the resulting file path against a whitelist, the 'File' object resolves to the sensitive system file.\nIf the application subsequently performs read operations on these file handles—such as streaming the file content back to the user or performing internal logic based on file contents—the attacker effectively gains read access to the file system.\nExploitation does not require authentication, assuming the affected parameters are exposed via publicly accessible endpoints. The lack of path normalization allows the 'File' constructor to interpret the attacker's input literally, enabling access to any file reachable by the user account running the Java Virtual Machine (JVM).\nPost-exploitation impact is severe. Beyond simple file disclosure, an attacker might be able to read sensitive configuration files containing database credentials or API keys. If the application environment allows for file uploads or writes, this vulnerability could potentially be chained with other flaws to overwrite critical system files or upload malicious binaries, leading to total system compromise."
}