A critical path traversal vulnerability in FileCodeBox allows unauthenticated remote attackers to perform arbitrary file writes, creating a significant risk of system compromise.

The application fails to validate filenames provided in user input within the SystemFileStorage.save_file method located in core/storage.py. This allows unauthenticated attackers to supply crafted POST requests to the /share/file/ upload endpoint, resulting in file writes outside the intended directory.

The ability for an unauthenticated attacker to write arbitrary files to the underlying server poses a severe threat to system integrity and confidentiality. Successful exploitation could lead to the placement of malicious scripts or configuration files, potentially resulting in remote code execution or total system takeover. Given the CVSS score of 7.5, this vulnerability represents a high-risk entry point that must be addressed immediately to prevent unauthorized access.

Immediate Action: Since a specific patch version is currently unknown, administrators should restrict access to the /share/file/ upload endpoint or disable the file upload functionality if it is not strictly required.

Proactive Monitoring: Review web server access logs for anomalous POST requests to the /share/file/ endpoint, specifically looking for path traversal sequences such as dot-dot-slash patterns.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block or sanitize incoming requests containing directory traversal sequences directed at the application storage endpoints.

Public Exploit Available: Unknown.

Given the lack of a verified patch and the availability of proof-of-concept information, organizations should prioritize isolating the affected FileCodeBox instances from public-facing networks. Until the vendor releases a security update, disabling the vulnerable upload endpoint is the most effective method to mitigate the risk of arbitrary file write attacks.