RockteMQ-AI commented on issue #2625: URL: https://github.com/apache/rocketmq-dashboard/issues/2625#issuecomment-5440274875
**Issue Evaluation** Category: / | Status: **Confirmed — High Severity** This is a valid directory traversal vulnerability. The Thu Aug 27 22:03:40 CST 2026 parameter in is concatenated directly into a file path without sanitization, allowing an attacker to read arbitrary files outside the data directory via sequences. **Root Cause:** Missing input validation on the Thu Aug 27 22:03:40 CST 2026 path parameter — no check for path traversal sequences (, ). **Impact:** Unauthorized file read within the server filesystem (any file accessible to the process). **Severity:** **High** — This is a security vulnerability that should be patched promptly. **Suggested fix:** Validate the Thu Aug 27 22:03:40 CST 2026 parameter against a strict pattern (e.g., ) and reject any value containing path separators or sequences. Alternatively, use and verify the resolved path stays within the expected data directory. This issue should be prioritized for the next release. --- *Automated evaluation by github-manager* -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
