ChestnutCMS Path Traversal Vulnerability in File Read Function

A path traversal vulnerability has been identified in ChestnutCMS versions through 1.5.3. The issue arises in the `readFile` function within the file `/dev-api/cms/file/read`. Manipulating the `filePath` argument allows for unauthorized file access by traversing directories. This vulnerability can be exploited remotely, potentially leading to the disclosure of sensitive files on the server.

Impact

Exploitation of this vulnerability allows for arbitrary file read access, which could be used to access sensitive information on the server.

Reproduction

To reproduce this vulnerability, send a request to the `/dev-api/cms/file/read` endpoint with a crafted `filePath` argument that includes directory traversal sequences. The request can be made using a tool like Postman or cURL. Bypass the file type whitelist by first creating a file with a permissible extension, then use the traversal technique to access restricted files.