upset-gal-web Arbitrary File Read Vulnerability

A directory traversal vulnerability allowing arbitrary file read has been identified in upset-gal-web version 7.1.0. The issue resides in the file '/api/music/v1/cover.ts'.

Impact

Exploitation of this vulnerability allows for arbitrary file reading on the server, which could lead to the disclosure of sensitive information.

Reproduction

The vulnerability can be reproduced by sending a GET request to '/api/music/v1/cover' with a 'cover' parameter that includes a directory traversal payload, such as '../../../../../../../etc/passwd'. This request will bypass normal file access restrictions and read the specified file.

Remediation

Users are advised to update to the latest version of upset-gal-web where this vulnerability has been fixed.