漏洞关键信息 漏洞类型: 附件上传未按卡片/板关系进行范围限制（Attachment upload not scoped to card/board relationship） 修复版本: commit 1d16955 提交者: xet7 提交日期: 2025年12月29日 主要修复内容 文件更改：server/routes/attachmentApi.js 添加验证： - 卡片是否属于指定的板 (card.belongsTo(boardId)) - 游泳道ID和列表ID是否匹配卡片的实际游泳道和列表 (card.swimlaneId 和 card.listId) - 用户是否有权限修改卡片 (board.isBoardMember(userId)) - 目标卡片是否属于目标板 (targetCard.belongsTo(targetBoardId)) - 目标板是否允许附件 (targetBoard.allowsAttachments) 错误响应代码： - 404：资源未找到 (Board not found, Card not found) - 400：请求无效 (Card does not belong to the specified board, Swimlane ID does not match the card's swimlane, List ID does not match the card's list, Target card does not belong to the specified board, Target swimlane ID does not match the card's swimlane, Target list ID does not match the card's list) - 403：权限不足 (You do not have permission to modify this card, You do not have permission to access this board, Attachments are not allowed on the target board)