cld378632668 JavaMall Path Traversal Vulnerability in MinioController Delete Function

A path traversal vulnerability allowing arbitrary file deletion has been identified in cld378632668 JavaMall versions through 994f1e2b019378ec9444cdf3fce2d5b5f72d28f0. The issue arises in the MinioController.java file, specifically within the delete function. The vulnerability is due to insufficient validation of the objectName parameter, which can be manipulated to traverse directories. This flaw can be exploited remotely, leading to serious consequences by allowing attackers to delete arbitrary files on the server.

Impact

Exploitation of this vulnerability could result in unauthorized deletion of files, potentially causing data loss or disruption of service.

Remediation

It is recommended to implement proper validation of file names and extensions in the delete function. Additionally, restrictions should be applied to prevent directory traversal attacks, ensuring that only intended files can be deleted.