JoeyBling SpringBoot_MyBatisPlus Path Traversal Vulnerability in File Download Function

A critical path traversal vulnerability has been identified in JoeyBling SpringBoot_MyBatisPlus versions up to a6a825513bd688f717dbae3a196bc9c9622fea26. The issue arises in the file download function, where improper validation of the 'name' argument allows attackers to manipulate file paths and access files outside of the intended directory. This vulnerability can be exploited remotely, potentially leading to unauthorized file access.

Impact

Exploitation of this vulnerability allows for arbitrary file reading, enabling attackers to access sensitive files on the server.

Reproduction

To reproduce this vulnerability, send a request to the '/file/download' endpoint with the 'name' parameter set to the path of the file to be accessed. Include the 'real' parameter set to true to bypass any restrictions. The server will respond with the contents of the specified file, demonstrating the path traversal vulnerability.