This vulnerability in yeqifu warehouse up to commit aaf29962ba407d22d991781de28796ee7b4670e4 involves improper handling of a file path argument in src/main/java/com/yeqifu/sys/controller/FileController.java, leading to path traversal. This allows remote attackers to access files outside the intended directory structure. The product's rolling release model means no fixed or affected versions are specified. The vendor has not provided any response or patch. The CVSS 4.0 base score is 5.3 (medium severity), with attack vector network, low complexity, no privileges required, no user interaction, and low impact on confidentiality.

An attacker can remotely exploit this vulnerability to perform path traversal, potentially accessing unauthorized files on the system. The impact on confidentiality is low, and there is no impact on integrity or availability as per the CVSS vector. No known exploits are currently active in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should monitor official channels for updates. Until a fix is released, consider restricting access to the affected functionality or implementing additional input validation controls if possible.