Description
Stonewuu ai-fusion-video through 1.2.0 contains a path traversal vulnerability that allows authenticated users to write uploaded files outside the media directory via the subDir parameter of POST /api/storage/upload. Attackers can supply parent-directory sequences that LocalStorageStrategy.storeBytes never normalizes, creating directories and writing attacker-controlled files with chosen extensions anywhere the service account can write.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Stonewuu ai-fusion-video
Default version status: unaffected
0 to ≤ 1.2.0affected
References
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/ai-fusion-video-broken-access-control-and-upload-path-traversal ↗
- https://github.com/Stonewuu/ai-fusion-video/blob/v1.2.0/ai-fusion-video/src/main/java/com/stonewu/fusion/service/storage/strategy/LocalStorageStrategy.java#L77-L92 ↗
- https://github.com/Stonewuu/ai-fusion-video/blob/v1.2.0/ai-fusion-video/src/main/java/com/stonewu/fusion/controller/storage/FileUploadController.java#L72-L99 ↗
- https://www.vulncheck.com/advisories/ai-fusion-video-through-1.2.0-path-traversal-in-media-upload-subdir-parameter ↗