CVE-2025-56815

CVE-2025-56815 Datart 1.0.0-rc.3 在 POST /viz/image 接口中存在目录遍历漏洞，因为服务器直接使用 MultipartFile.transferTo 将上传的文件保存到用户可控的路径，并且缺乏对文件名的严格验证。 root@kitploit: POST /api/v1/files/viz/image?ownerType=DASHBOARD&ownerId=66822c13a9bc4381923456c11339497e&fileName=../../../../../../../../tmp/1 HTTP/1.1 Host: test.com...

CVE-2025-56815

Datart 1.0.0-rc.3 is vulnerable to Directory Traversal in the POST /viz/image interface, since the server directly uses MultipartFile.transferTo to save the uploaded file to a path controllable by the user, and lacks strict verification of the file name...

datart 安全漏洞

datart is an open source data visualization open platform by running-elephant. A security vulnerability exists in datart version 1.0.0-rc.3, which stems from the POST /viz/image interface not strictly validating filenames, which could lead to a directory traversal attack...