CyberRota Analysis
AI-GeneratedAn arbitrary file upload and path traversal vulnerability in LZ-litchi 1.0.0 allows unauthenticated remote attackers to upload files and write them outside the designated storage directory through the directory parameter in the POST /app-api/infra/file/upload endpoint. This could lead to unauthorized access to sensitive files or execution of malicious code on the server. Organizations using this version of LZ-litchi should prioritize patching this vulnerability to mitigate potential exploitation risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
An arbitrary file upload and path traversal vulnerability exists in LZ-litchi 1.0.0. Unauthenticated remote attackers can upload arbitrary files and write them outside the intended storage directory via the directory parameter in POST /app-api/infra/file/upload.