This vulnerability in Dromara lamp-cloud up to version 5.10.0 allows remote attackers to perform path traversal by manipulating the bucket or bizType parameters in the FileAnyoneController.java file upload controller component. This could enable unauthorized access to files outside the intended directory. The issue was reported early but the vendor has not responded or provided a fix. The CVSS 4.0 score is 6.9 (medium severity) with network attack vector, low complexity, no privileges or user interaction required, and limited confidentiality, integrity, and availability impacts. No official remediation or patch is currently available.

Successful exploitation allows remote attackers to traverse directories via crafted bucket or bizType arguments, potentially accessing unauthorized files on the server. This can lead to information disclosure or other impacts depending on the files accessed. The vulnerability does not require authentication or user interaction and has limited impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should consider implementing temporary mitigations such as input validation or filtering on the bucket and bizType parameters to prevent path traversal. Monitor for updates from the vendor for an official fix.