Dromara lamp-cloud versions up to 5.10.0 contain a path traversal vulnerability (CWE-22) in the FileAnyoneController.java file-upload controller component. By manipulating the bucket or bizType arguments, an attacker can perform unauthorized path traversal remotely. The vulnerability has been publicly disclosed with exploit code available, but no active exploitation has been reported. The project has been informed but has not provided a patch or official response.

Successful exploitation could allow an attacker to read or write files outside the intended directory structure, potentially leading to information disclosure, data modification, or denial of service. The vulnerability is remotely exploitable without authentication and affects confidentiality, integrity, and availability to a limited extent.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the project has not responded or issued a fix, users should monitor official channels for updates. Until a patch is available, consider restricting access to the vulnerable component or applying network-level controls to limit exposure.