Impact Analysis

The vulnerability allows an attacker to remotely perform path traversal, which can lead to unauthorized access to files on the server. This could expose sensitive information or system files, potentially compromising the security of the affected system.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in liweiyi ChestnutCMS up to version 1.5.8, specifically in the resourceDownload function of the /dev-api/common/download file. By manipulating the 'path' argument, an attacker can perform a path traversal attack, potentially accessing files outside the intended directory. The attack can be executed remotely and the exploit has been publicly disclosed.

Useful 0 Not Useful 0