The flaw allows an attacker to manipulate the Username field in the Avatar Upload workflow, causing a path traversal error that can expose arbitrary files on the server. It is a local file access vulnerability of type CWE‑22 and can be triggered remotely, leading to potential confidentiality and integrity breaches. No evidence of remote code execution has been described.

The vulnerability exists in weiqingwen spring‑boot‑forum up to commit 538eecc3c6b85fdf0768ab4e8354b48c0c17d94f. Continuous delivery and rolling releases mean no version beyond this commit is known to be fixed, and the vendor has not released an official fix. All installations prior to a patch or an updated compliant commit are vulnerable.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score is not available, which suggests uncertainty about the likelihood of exploitation, but the vulnerability has been publicly disclosed and can be activated remotely. It is not listed in the CISA KEV catalog, yet the known path traversal can still be used for information disclosure or further compromise if other weaknesses exist. The attacker only needs to supply a crafted Username value; no other preconditions are stated.