YiJiuSmile kkFileViewOfficeEdit Path Traversal Vulnerability in Download Function

A critical path traversal vulnerability has been identified in YiJiuSmile kkFileViewOfficeEdit versions prior to 5fbc57c48e8fe6c1b91e0e7995e2d59615f37abd. The issue arises in the 'Download' function of the '/download' file, where manipulation of the 'url' argument allows for unauthorized arbitrary file reading. This vulnerability can be exploited remotely.

Impact

Exploitation of this vulnerability allows for arbitrary file reading on the server where the application is hosted.

Reproduction

To reproduce this vulnerability, send a request to the '/download' endpoint with a 'url' parameter that specifies the absolute path of the file to be read. The application will return the contents of the specified file, bypassing normal directory restrictions.