Yottamaster DM2/DM3/DM200 File Upload Path Traversal Vulnerability

A path traversal vulnerability has been identified in Yottamaster DM2, DM3, and DM200 versions through 1.2.23/1.9.12. This vulnerability arises from the File Upload component, where improper handling of file paths allows for traversal outside of intended directories. The issue can be exploited remotely, and a public proof-of-concept exploit is available.

Impact

Exploitation of this vulnerability allows for unauthorized file operations, potentially leading to horizontal and vertical privilege escalation.