JFinal CMS Path Traversal Vulnerability in Template Rendering

A path traversal vulnerability has been identified in JFinal CMS versions through 5.2.4. The issue arises in the template rendering function 'engine.getTemplate' within the '/readTemplate' file. The vulnerability allows for arbitrary file reading by manipulating the 'template' argument, as the application does not properly validate or sanitize the input before using it to construct file paths. This flaw can be exploited remotely, taking advantage of JFinal's built-in Enjoy template engine.

Impact

Exploitation of this vulnerability allows for arbitrary file reading on the server, potentially leading to the disclosure of sensitive information.

Reproduction

To reproduce this vulnerability, send a request to the '/readTemplate' endpoint with a crafted 'template' parameter that includes path traversal sequences. This will bypass the application's path restrictions and access files outside the intended directory.