图片1.png

Analysis:

The endpoint /file/showImageByPath accepts a user-supplied path parameter. This path is passed directly to AppFileUtils.createResponseEntity(path).

图片2.png

Following the createResponseEntity method reveals that it concatenates the base directory path with the user input using getChars into an array, without proper validation. This allows directory traversal sequences (e.g., ../), leading to arbitrary file download.

图片3.png

Reproduction:

The endpoint route is /file/showImageByPath.

I created a test folder locally containing a file 1.txt.

图片4.png

Construct the payload:

http://127.0.0.1:9191/file/showImageByPath?path=../../../../../../../../../../../../test/1.txt

After logging into the locally deployed website, directly access:

/file/showImageByPath?path=../../../../../../../../../../../../test/1.txt

图片5.png

图片6.png