This vulnerability exists in the validate function of src/main/java/com/qingwenwei/util/NewUserFormValidator.java within the Avatar Upload component of the weiqingwen spring-boot-forum. By manipulating the Username argument, an attacker can perform a path traversal attack remotely. The vulnerability affects all versions up to commit 538eecc3c6b85fdf0768ab4e8354b48c0c17d94f. Due to the product's continuous delivery model with rolling releases, no discrete version numbers are provided. The vendor was contacted but did not respond. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, no user interaction, and low impacts on confidentiality, integrity, and availability.

An attacker can remotely exploit this vulnerability to perform path traversal via the Username argument in the Avatar Upload feature. This could potentially allow unauthorized access to files outside the intended directory, leading to information disclosure or other impacts depending on server configuration. The CVSS score of 5.3 indicates a medium impact with limited confidentiality, integrity, and availability effects. No known active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no fixed versions are published, users should monitor official channels for updates. Until a fix is available, consider restricting access to the vulnerable functionality or implementing additional input validation to mitigate path traversal risks.