Executive brief
DTStack Taier is a big data development platform for workflow submission and scheduling. A deprecated but still-active file upload endpoint accepts unsanitized file paths, allowing attackers to probe for the existence of arbitrary files on the server and determine their exact size through response timing or behavioral differences. This enables information disclosure of sensitive system files without authentication.
Technical details
The vulnerability is a path traversal (CWE-22) in the FileChunkController's /chunk/check endpoint. The controller concatenates an attacker-controlled "name" parameter directly into a file path using Paths.get() without canonicalization or validation, then returns a boolean indicating whether the file exists and its size matches. An attacker can supply traversal sequences (../) or absolute paths to enumerate arbitrary files and learn their exact byte length. The endpoint is marked @Deprecated and @Hidden but remains mapped and reachable; no authentication or URI-level authorization is enforced. Exploitation requires only network access to POST a JSON payload to /chunk/check.
Affected products
- DTStack Taier 1.4.0
Timeline
- 2026-08-14: disclosed
- 2026-06-25: other: Vulnerability reported on GitHub issue #1203