A flaw within the FileAnyoneController component of Dromara lamp‑cloud allows an attacker to manipulate the bucket/bizType parameters to perform a directory traversal. The vulnerability can be triggered remotely and is publicly documented, enabling attackers to read or write files outside the intended upload directory. This can lead to exposure of sensitive data or the ability to upload files that the application then processes, potentially escalating to code execution. The weakness is a classic path traversal flaw, identified as CWE‑22.

All installations of Dromara lamp‑cloud up to version 5.10.0 are vulnerable. The problematic code resides in FileAnyoneController.java within the File‑Upload Controller component. Any system running a version of lamp‑cloud that has not yet been updated beyond 5.10.0 is at risk.

The CVSS score of 6.9 indicates a moderate severity, and while the EPSS score is unavailable, the vulnerability is publicly disclosed and can be exploited remotely. The issue is not yet listed in the CISA KEV catalog. Attackers would need to craft a payload that supplies specially crafted bucket/bizType values, which the application currently does not sanitize, enabling traversal of the file system. This lack of input validation places systems at risk of unauthorized file access or deployment of malicious files.