arbitrary file read vulnerability

[bkfish]

poc

After login as admin,file manager and downloadfunction after change path param can read arbitrary file

analysis

location:include/File.php

we can use ../ to traverse to the previous directory

suggest

you can check path ,for example check if it has .. then refuse this request