Aaluoxiang OA System Path Traversal Vulnerability in UserpanelController

A path traversal vulnerability has been identified in the Aaluoxiang OA System, specifically in versions prior to the commit 5b445a6227b51cee287bd0c7c33ed94b801a82a5. The issue resides in the UserpanelController.java file, within the 'image' function. This vulnerability allows remote attackers to read arbitrary files on the server by exploiting the API route 'image/**', potentially leading to unauthorized disclosure of sensitive information.

Impact

Exploitation of this vulnerability allows for arbitrary file read, which could result in the leakage of sensitive information from the server.

Reproduction

To reproduce this vulnerability, deploy the Aaluoxiang OA System project and log in to obtain a valid 'JSESSIONID' cookie. Then, send a GET request to the 'image' endpoint, including a path traversal payload that uses '../' to navigate to a sensitive file, such as 'passwd.txt'.