Bisheng Directory Traversal Vulnerability in File Download

Bisheng versions 2.3.0, 2.4.0, and 2.4.0-beta1 are vulnerable to a directory traversal issue in the save_download_file function in src/backend/bisheng/core/cache/utils.py.

An attacker could exploit this flaw to read files outside the intended download directory.

• Affected versions: 2.3.0, 2.4.0, 2.4.0-beta1
• Vulnerable location: src/backend/bisheng/core/cache/utils.py:290