This vulnerability exists in the ToolController.download function of kerwincui FastBee (up to version 1.2.1). By manipulating the fileName parameter, an attacker can perform path traversal to access files outside the intended directory scope. The vulnerability is remotely exploitable without user interaction and requires low privileges. Public exploit code is available. No vendor response or patch has been provided as of the publication date.

Successful exploitation allows an attacker to read arbitrary files on the affected system by traversing directories via the fileName parameter. This can lead to unauthorized disclosure of sensitive information. The vulnerability does not require user interaction and can be triggered remotely with low complexity. However, it does not provide direct code execution or privilege escalation based on the available data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider implementing temporary mitigations such as restricting access to the Tool Download Endpoint, validating and sanitizing the fileName parameter at the application level, or deploying web application firewalls to detect and block path traversal attempts.