关键漏洞信息 漏洞类型 Type: Path Traversal / Directory Traversal (CWE-22) 产品信息 Vendor: Dreampie Product: Resty Framework - HttpClient Module Affected Versions: All versions <= 1.3.1.SNAPSHOT (including all historical releases) Fixed Version: None (currently unfixed as of 2025-11-02) 攻击类型 Attack Type: Remote 影响信息 Impact: Code Execution, Escalation of Privileges, Information Disclosure, Denial of Service 受影响组件 File: /resty-httpclient/src/main/java/cn/dreampie/client/HttpClient.java Lines: 157-178 Function: File download with automatic filename extraction from Content-Disposition header Primary Discoverer: s1ain CVSS评分 CVSS 3.1 Score: 8.1 (HIGH) Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H 发现者信息 Primary Discoverer: s1ain Discovery Method: Systematic security audit of Resty framework Organization: Independent Security Researcher 参考信息 Resty Framework HttpClient Source Code CWE-22 OWASP Path Traversal 额外信息 Technical Details: Root cause analysis, evidence of security regression, and comparison with other security measures. Proof of Concept: Included in the full vulnerability report. Impact on Deployment: Affects various applications and systems. Remediation Status: Pending responsible disclosure timeline (90 days after vendor notification). 披露时间线 Nov 1, 2025: Vulnerability discovered during comprehensive security audit Nov 2, 2025: CVE application submitted Pending: Vendor notification via GitHub security advisory Pending: 90-day disclosure timeline begins after vendor acknowledgment Pending: Public disclosure with technical details and PoC