WebFileSys Directory Traversal Vulnerability in relPath Parameter

A directory traversal vulnerability has been identified in WebFileSys version 2.31.0. The issue arises in the relPath parameter, where attackers can inject traversal payloads through crafted HTTP requests. This manipulation of file paths may lead to unauthorized access to sensitive files, potentially exposing data outside the intended directory.

Impact

Exploitation of this vulnerability allows for directory traversal, enabling attackers to access files and directories outside the web root, potentially leading to the exposure of sensitive information.

Reproduction

To reproduce this vulnerability, send a GET request to the WebFileSys servlet with the relPath parameter set to include directory traversal payloads, such as '/../..'. This request should be made while logged into the application, as indicated by the inclusion of a session cookie.