An unauthenticated critical file upload vulnerability in LZ-litchi 1.0.0 enables remote attackers to achieve arbitrary file writes, posing a severe risk of system compromise.

This vulnerability involves an arbitrary file upload and path traversal flaw within the POST /app-api/infra/file/upload endpoint. An unauthenticated attacker can exploit the directory parameter to bypass storage restrictions and execute arbitrary file writes on the host system.

The ability to upload and place arbitrary files on a server creates a direct path for remote code execution and total system compromise. Given the CVSS score of 9.8, this vulnerability is classified as critical, as it allows attackers to gain full control over the application environment and potentially pivot deeper into the internal network.

Immediate Action: Since no official patch is currently available, administrators should restrict access to the /app-api/infra/file/upload endpoint or disable the upload functionality entirely until a vendor-supplied update is released.

Proactive Monitoring: Security teams should monitor server access logs for unusual POST requests to the file upload endpoint, specifically looking for directory traversal strings such as dot-dot-slash sequences in the directory parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block or sanitize requests containing path traversal characters or suspicious file extensions directed at the affected API endpoint.

Public Exploit Available: Unknown

This vulnerability represents a critical security failure due to the lack of input validation on file upload parameters. Organizations utilizing LZ-litchi 1.0.0 must prioritize isolating the affected service from public-facing networks immediately and monitor for vendor updates to address the underlying code deficiency.