[漏洞] xszyou/Fay 中未经授权的路径遍历导致任意目录删除

gui/flask_server.py, line 988-1020

@__app.route('/api/delete-user', methods=['POST']) def api_delete_user(): """Delete the user and all of their data (chat logs, memory files).""" data = request.get_json() username = data['username'] # ← attacker-controlled, from JSON body # Only check: username != 'User' if username == 'User': return jsonify({'success': False, 'message': 'Cannot delete the master account'}), 400 # ... base_dir = os.path.dirname(os.path.dirname(os.path.abspath(file))) mem_base = os.path.join(base_dir, "memory") user_memory_dir = os.path.join(mem_base, str(username)) # ← PATH TRAVERSAL if os.path.exists(user_memory_dir) and os.path.isdir(user_memory_dir): import shutil shutil.rmtree(user_memory_dir) # ← RECURSIVE DIRECTORY DELETION