This vulnerability exists in yeqifu warehouse up to commit aaf29962ba407d22d991781de28796ee7b4670e4. It involves improper handling of the 'path' argument in src/main/java/com/yeqifu/sys/controller/FileController.java, enabling path traversal attacks remotely. The vulnerability has been publicly disclosed, but no patch or remediation information is available due to the rolling release nature of the product and lack of vendor response.

Successful exploitation allows remote attackers to perform path traversal, potentially accessing files outside the intended directory scope. This could lead to unauthorized information disclosure or other impacts depending on the files accessed. The CVSS 4.0 score of 5.3 reflects a medium impact with network attack vector, low complexity, no privileges required, and no user interaction needed.

Patch status is not yet confirmed—check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch links are available, users should monitor official channels for updates. Until a fix is released, restricting access to the vulnerable functionality or implementing additional input validation may reduce risk.