This vulnerability in alldatacenter alldata (versions 0.6.0 through 0.6.8) involves improper validation of the executorAddress parameter in the FileInputStream function of the JobLogController.java file's logDetailCat endpoint. This allows an attacker to perform path traversal attacks remotely, potentially accessing unauthorized files on the server. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity) with network attack vector, low attack complexity, no privileges or user interaction required, and low impact on confidentiality. The project has closed the issue report as "not planned" and no official fix or patch is available. An exploit has been published, but no known exploitation in the wild has been confirmed.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to read arbitrary files on the server by manipulating the executorAddress parameter, potentially leading to information disclosure. The impact on confidentiality is low, and there is no impact on integrity or availability. There is no indication of privilege escalation or remote code execution. No active exploitation in the wild has been reported.

No official fix or patch is currently available as the project has closed the issue as "not planned." Users should consider implementing network-level restrictions to limit access to the affected endpoint or deploy web application firewalls to detect and block path traversal attempts. Monitor for any updates from the vendor or community regarding potential patches or mitigations.