Warehouse Management System 1.2 contains a critical arbitrary file deletion vulnerability that allows authenticated attackers to compromise system integrity by deleting essential server files.

This is an arbitrary file deletion vulnerability caused by improper validation of the goodsimg parameter within the /goods/deleteGoods endpoint. A remote authenticated attacker can leverage directory traversal sequences to delete sensitive files on the host server.

The ability to delete arbitrary files on a production server poses a severe threat to operational continuity and system integrity. An attacker could remove critical system configuration files, application binaries, or database entries, resulting in significant service downtime. Given the CVSS score of 8.1, this vulnerability represents a high risk that requires immediate attention to prevent malicious disruption.

Immediate Action: Since no official patch is currently available, administrators should restrict access to the /goods/deleteGoods endpoint to only the most trusted administrative accounts. If possible, disable the functionality entirely until the vendor provides a secure update.

Proactive Monitoring: Monitor application logs for suspicious directory traversal patterns, such as sequences containing "../" or encoded variations, targeting the /goods/deleteGoods endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to inspect and block HTTP requests to the /goods/deleteGoods endpoint that contain directory traversal payloads in the goodsimg parameter.

Public Exploit Available: No (the referenced GitHub issue provides technical details but does not constitute a weaponized exploit).

This vulnerability presents a high risk to organizational infrastructure due to the potential for catastrophic system disruption via arbitrary file deletion. Security teams should prioritize restricting access to the affected endpoint immediately and maintain vigilance for any anomalous activity. Once the vendor releases an official security patch, it should be applied as a matter of urgency to resolve the underlying input validation failure.