Doramart DoraCMS Path Traversal Vulnerability in v3.0.x

A path traversal vulnerability has been identified in doramart DoraCMS version 3.0.x. The issue arises in the 'createFileByPath' function within the file '/DoraCMS/server/app/router/api/v1.js'. This vulnerability allows for remote exploitation, where an attacker can manipulate input to traverse the file system and potentially access sensitive files. The vulnerability has been publicly disclosed, and an exploit is available.

Impact

Exploitation of this vulnerability allows for unauthorized file access and exfiltration via the application's cloud storage integration, according to the VulDB entry.

Reproduction

To reproduce this vulnerability, upload a file using the 'catchimage' feature, which will create a readable file on the server. Then, send a POST request to '/api/v1/files/path' with a payload that includes the path of the uploaded file, effectively leveraging the path traversal flaw to access and download the file through the application's CDN.