Zhijiantianya Ruoyi-Vue-Pro Path Traversal Vulnerability in File Upload Interface

A critical path traversal vulnerability has been identified in Zhijiantianya Ruoyi-Vue-Pro version 2.4.1. The issue arises in the backend file upload interface, specifically within the admin-api/infra/file/upload endpoint. The vulnerability allows for remote exploitation by manipulating the 'path' argument, potentially leading to unauthorized access to the file system.

Impact

Exploitation of this vulnerability allows for path traversal, which could be used to access files outside of the intended directory, potentially leading to the disclosure of sensitive information or further exploitation of the application.