{"id":6893,"date":"2025-06-16T01:24:31","date_gmt":"2025-06-16T01:24:31","guid":{"rendered":"http:\/\/localhost\/?p=6893"},"modified":"2025-06-16T01:24:31","modified_gmt":"2025-06-16T01:24:31","slug":"hansonwang99-spring-boot-in-action-file-upload-imageuploadservicejava-watermarktest-path-traversal","status":"publish","type":"post","link":"https:\/\/zero.redgem.net\/?p=6893","title":{"rendered":"hansonwang99 Spring-Boot-In-Action File Upload ImageUploadService.java watermarkTest path traversal"},"content":{"rendered":"
\n

CVE Details<\/h2>\n
\n
\n

Basic Information<\/h3>\n\n\n\n\n\n
Title<\/th>\nhansonwang99 Spring-Boot-In-Action File Upload ImageUploadService.java watermarkTest path traversal<\/td>\n<\/tr>\n
Type<\/th>\ncve<\/td>\n<\/tr>\n
Published<\/th>\n2025-06-16T05:31:05.347Z<\/td>\n<\/tr>\n
Last Seen<\/th>\n<\/td>\n<\/tr>\n<\/table>\n<\/div>\n
\n

Product Information<\/h3>\n\n\n\n\n
Vendor<\/th>\nhansonwang99<\/td>\n<\/tr>\n
Product<\/th>\nSpring-Boot-In-Action<\/td>\n<\/tr>\n
Version<\/th>\n807fd37643aa774b94fd004cc3adbd29ca17e9aa<\/td>\n<\/tr>\n<\/table>\n<\/div>\n<\/div>\n
\n

CVSS Information<\/h3>\n\n\n\n\n\n\n
Base Score<\/th>\n5.3 (MEDIUM)<\/td>\n<\/tr>\n
Attack Vector<\/th>\nCVSS:4.0\/AV:N\/AC:L\/AT:N\/PR:L\/UI:N\/VC:L\/VI:L\/VA:L\/SC:N\/SI:N\/SA:N\/E:P<\/td>\n<\/tr>\n
Confidentiality Impact<\/th>\n<\/td>\n<\/tr>\n
Integrity Impact<\/th>\n<\/td>\n<\/tr>\n
Availability Impact<\/th>\n<\/td>\n<\/tr>\n<\/table>\n<\/div>\n
\n

AI Analysis<\/h3>\n\n\n\n\n\n\n
AI Description<\/th>\nA critical path traversal vulnerability was found in the Spring-Boot-In-Action project’s file upload component, specifically in the `watermarkTest` function of `ImageUploadService.java`. The vulnerability allows remote attackers to perform path traversal attacks by manipulating the `filename` argument. The exploit has been publicly disclosed and may be used in attacks. The product uses rolling releases, so specific affected and patched versions are not available. The vendor was contacted but did not respond.<\/td>\n<\/tr>\n
AI Severity<\/th>\nCritical<\/td>\n<\/tr>\n
Vendor<\/th>\nhansonwang99<\/td>\n<\/tr>\n
Product<\/th>\nSpring-Boot-In-Action<\/td>\n<\/tr>\n
Affected Version<\/th>\nup to 807fd37643aa774b94fd004cc3adbd29ca17e9aa<\/td>\n<\/tr>\n<\/table>\n<\/div>\n
\n

Affected Products<\/h4>\n