Executive brief
yeqifu is a Java application framework that includes a file handling component. A path traversal vulnerability in the FileController allows attackers to access files outside intended directories by manipulating the path parameter, potentially exposing sensitive application files and configuration data.
Technical details
A path traversal vulnerability exists in src/main/java/com/yeqifu/sys/controller/FileController.java where user-supplied input in the path argument is not properly validated or sanitized. An unauthenticated attacker can craft malicious path parameters (e.g., using ".." sequences) to traverse the filesystem and read arbitrary files accessible to the application process. The vulnerability is remotely exploitable over the network. The vendor has not responded to early disclosure notifications, and no patches are currently available given the product's rolling release model.
Affected products
- yeqifu up to aaf29962ba407d22d991781de28796ee7b4670e4
Timeline
- 2026-08-05: disclosed
- 2026-08-05: advisory