Seeyon Zhiyuan OA Web Application System Path Traversal Vulnerability in ZIP File Handler

A path traversal vulnerability has been identified in Seeyon Zhiyuan OA Web Application System version 8.1 SP2. The issue arises in the ZIP File Handler component, specifically within the Download function of the M3CoreController class, located in the seeyon-apps-m3.jar file. The vulnerability allows for remote exploitation by manipulating the Name argument, potentially leading to unauthorized access to files on the server.

Impact

Exploitation of this vulnerability allows for path traversal, which could be used to access sensitive files on the server outside of the intended directory.