Headline
CVE-2021-45746: Path Manipulation · Issue #2297 · WeBankPartners/wecube-platform
A Directory Traversal vulnerability exists in WeBankPartners wecube-platform 3.2.1 via the file variable in PluginPackageController.java.
protected UploadPackageResultDto performUploadPackage(MultipartFile pluginPackageFile, File localFilePath) {
String pluginPackageFileName = pluginPackageFile.getName();
if (!localFilePath.exists()) {
if (localFilePath.mkdirs()) {
log.info("Create directory [{}] successful", localFilePath.getAbsolutePath());
} else {
String errMsg = String.format("Create directory [%s] failed.", localFilePath.getAbsolutePath());
throw new WecubeCoreException("3099", errMsg, localFilePath.getAbsolutePath());
}
}
File dest = new File(localFilePath, “/” + pluginPackageFileName);
try {