A critical path traversal vulnerability in the weiqingwen spring-boot-forum application allows authenticated attackers to perform arbitrary file overwriting on the host system.

The application fails to sanitize the username parameter during the avatar upload process in the validate function, enabling path traversal sequences. An authenticated user can leverage this flaw to escape the intended upload directory and overwrite critical system files.

Successful exploitation of this vulnerability allows an attacker to overwrite arbitrary files, which could lead to full system compromise, application downtime, or the injection of malicious code. Although the CVSS score is 6.3, the potential for arbitrary file write elevates the risk significantly, as it provides a clear path for an attacker to gain elevated control over the server environment.

Immediate Action: As there is no official patch provided by the vendor, administrators should restrict avatar upload functionality or implement strict input validation on the username field to reject any directory traversal characters.

Proactive Monitoring: Monitor server logs for suspicious requests to the avatar upload endpoint, particularly those containing encoded path traversal sequences like "../".

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block HTTP requests containing directory traversal patterns in the username field during avatar upload operations.

Public Exploit Available: Yes — a published proof-of-concept exists, as documented in the GitHub issue referenced in the research write-up.

Given the availability of a public proof-of-concept and the high impact of arbitrary file overwriting, this vulnerability poses a significant risk to the integrity of the host server. Organizations should immediately implement input validation or disable the affected feature until the vendor provides a formal security update or a stable release version is available.