A directory traversal vulnerability in Datart 1.0.0-rc.3 allows unauthenticated attackers to potentially overwrite or place files on the server, posing a significant risk to system integrity.

This vulnerability is a directory traversal flaw located in the POST /viz/image endpoint. It occurs because the application uses user-supplied input in the MultipartFile.transferTo method without sufficient validation, allowing an unauthenticated attacker to manipulate the destination path of uploaded files.

Successful exploitation of this flaw could allow an attacker to write files to arbitrary locations on the host file system. This unauthorized file placement can lead to the overwriting of critical configuration files or the placement of malicious scripts, resulting in full system compromise or service disruption. Given the CVSS score of 7.1, this represents a high-severity risk that requires prompt attention to maintain operational security.

Immediate Action: Since no specific patch version is currently identified, verify if a newer release has been issued via the official Datart GitHub repository and update immediately. If no update is available, restrict access to the /viz/image endpoint at the network or web server level.

Proactive Monitoring: Review web server and application logs for suspicious POST requests to the /viz/image endpoint, specifically looking for path traversal sequences like double dots or absolute paths in file upload parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule designed to detect and block directory traversal attempts and unauthorized file upload patterns targeting the /viz/image interface.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub repository at https://github.com/xiaoxiaoranxxx/CVE-2025-56815.

The presence of a public proof-of-concept elevates the risk profile of this directory traversal vulnerability. Administrators should prioritize identifying instances of Datart 1.0.0-rc.3 in their environment and apply vendor updates as soon as they become available. Until a patch is confirmed, implementing restrictive access controls or WAF filtering is essential to prevent potential exploitation.