Dromara lamp-cloud Path Traversal Flaws

Path traversal in Dromara lamp-cloud up to version 5.10.0 allows remote unauthenticated attackers to manipulate file storage paths via the bucket and bizType parameters in FileAnyoneController.java. The affected endpoint appears intentionally public (indicated by the 'Anyone' controller name), lowering the bar for exploitation significantly. No vendor patch is available at time of analysis, and a public proof-of-concept exploit exists, though no CISA KEV listing confirms active mass exploitation.

Path traversal in dromara lamp-cloud (versions up to 5.10.0) exposes the chunk-check endpoint of FileChunkController.java to remote directory traversal via a crafted 'Name' argument, potentially allowing attackers to read or write files outside the intended upload directory. No authentication is required per the CVSS 4.0 vector (PR:N), and a public exploit has been disclosed (CVSS E:P modifier), lowering the barrier for opportunistic exploitation. The vendor was notified via GitHub issue #413 but has not yet responded, leaving no official patch available at time of analysis.