Zhijiantianya Ruoyi-Vue-Pro Path Traversal Vulnerability in Material Upload Interface

A path traversal vulnerability has been identified in Zhijiantianya Ruoyi-Vue-Pro version 2.4.1. This issue arises in the material upload interface, specifically within the '/admin-api/mp/material/upload-temporary' endpoint. The vulnerability allows for arbitrary file deletion by manipulating the 'file' argument to traverse directories and access files that the application can reach.

Impact

Exploitation of this vulnerability allows for arbitrary file deletion on the server. If a file such as an SSH private key is deleted on a Linux server, it could result in a loss of server access privileges.

Reproduction

To reproduce this vulnerability, upload a file through the '/admin-api/mp/material/upload-temporary' interface using a directory traversal payload in the 'file' parameter. The traversal can be used to delete files accessible by the application, such as those in the AppData directory.