Spring Boot Forum
Monthly
Path traversal in weiqingwen spring-boot-forum lets an authenticated forum user escape the intended avatar storage path by manipulating the Username argument processed in NewUserFormValidator.validate during avatar upload. The issue is remotely reachable and, per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), requires a valid forum account while yielding only Low confidentiality and integrity impact because the traversal is scoped to the avatar file-handling path. Publicly available exploit code exists, the maintainer did not respond to the disclosure, and because the project ships rolling releases with no tagged versions there is no known fixed release to migrate to.
Path traversal in weiqingwen spring-boot-forum lets an authenticated forum user escape the intended avatar storage path by manipulating the Username argument processed in NewUserFormValidator.validate during avatar upload. The issue is remotely reachable and, per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), requires a valid forum account while yielding only Low confidentiality and integrity impact because the traversal is scoped to the avatar file-handling path. Publicly available exploit code exists, the maintainer did not respond to the disclosure, and because the project ships rolling releases with no tagged versions there is no known fixed release to migrate to.