YiShaAdmin Admin Panel Path Traversal File Read/Delete Bug

YiShaAdmin versions 2.2 through 3.1, fixed in commit 025b062, contain an unauthenticated path traversal vulnerability in the /admin/File/DownloadFile endpoint.

Attackers can send crafted GET requests with directory traversal sequences in the filePath parameter and set the delete parameter to read or delete arbitrary files, including system files like etc/passwd.

• Affected versions: YiShaAdmin 2.2 through 3.1
• Fixed in: commit 025b062
• Attack type: unauthenticated, via GET requests
• Impact: arbitrary file read and deletion
• First observed in the wild by Shadowserver Foundation on 2023-10-20