Vector4wang Spring Boot Quick Path Traversal Vulnerability in Img2Txt Component

A critical path traversal vulnerability has been identified in the Vector4wang Spring Boot Quick project, specifically in the Img2Txt component, versions prior to 20250422. The issue arises in the Img2TxtController, within the ResponseEntity function, where improper handling of file paths allows for traversal attacks. This vulnerability can be exploited remotely, and has been publicly disclosed.

Impact

Exploitation of this vulnerability allows for path traversal, which could lead to unauthorized file access on the server.

Reproduction

The vulnerability can be reproduced by sending a request that includes a crafted file path, exploiting the path traversal flaw in the Img2TxtController's ResponseEntity function. This can be done remotely, taking advantage of the improper validation of file paths to access restricted files on the server.