An unauthenticated path traversal flaw exists in YiShaAdmin versions 2.2 through 3.1, located in the /admin/File/DownloadFile endpoint. By supplying a crafted filePath parameter that contains directory traversal sequences, an attacker can read or delete any file the web server can access, including sensitive files such as /etc/passwd. The flaw also allows setting a delete flag, enabling deletion of arbitrary files without user credentials.

The affected product is YiShaAdmin released by liukuo362573, specifically versions 2.2 to 3.1. The vulnerability was mitigated in commit 025b0628, and later commits are considered safe. Users running the unpatched versions are at risk.

The CVSS score of 8.8 indicates high severity, and the exploit requires only a crafted HTTP GET request without authentication. No EPSS score is available, and the issue is not listed in CISA KEV. A potential attacker would target the vulnerable endpoint directly, constructing a filePath that navigates outside the intended directory and, optionally, uses the delete parameter to remove files. This path traversal is trivial to perform via standard browsers or automated tools, making the vulnerability readily exploitable.