This vulnerability in dromara lamp-cloud up to version 5.10.0 involves improper handling of the 'Name' argument in the chunk-check endpoint within FileChunkController.java. An attacker can manipulate this argument to perform path traversal attacks, potentially accessing files outside the intended directory. The issue is remotely exploitable without privileges or user interaction. Although the vulnerability was reported early, the vendor has not issued a patch or official remediation. Public exploit information is available, increasing the risk of exploitation.

Successful exploitation allows an unauthenticated remote attacker to perform path traversal, potentially reading or accessing unauthorized files on the server hosting lamp-cloud. This could lead to information disclosure or further compromise depending on the files accessed. The CVSS 4.0 base score is 6.9 (medium severity), reflecting network attack vector, low complexity, no privileges required, and low to low integrity and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should monitor official channels for updates. Until a patch is available, consider implementing access controls or input validation workarounds to restrict path traversal attempts on the chunk-check endpoint.