rachelos WeRSS we-mp-rss Path Traversal Vulnerability in Export Download Function

A path traversal vulnerability has been identified in rachelos WeRSS we-mp-rss versions through 1.4.8. The issue arises in the download_export_file function within apis/tools.py, where improper handling of the filename argument allows for manipulation that leads to unauthorized access to files outside the intended directory. This vulnerability can be exploited remotely, and a public proof-of-concept exploit is available.

Impact

Exploitation of this vulnerability allows for arbitrary file read access, enabling an attacker to access sensitive files outside the application's designated directory.