Description
/api/thumbnail端点中存在目录遍历漏洞，该漏洞是由于应用对fileName参数的值验证不当导致的。
LG LED Assistant thumbnail 目录遍历漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://www.zerodayinitiative.com/advisories/ZDI-23-1223/
https://avd.aliyun.com/detail?id=AVD-2023-4616
https://nvd.nist.gov/vuln/detail/CVE-2023-4616
https://www.tenable.com/security/research/tra-2024-08
https://cve.imfht.com/vendor/LG%20Electronics
https://lgsecurity.lge.com/bulletins/idproducts
https://www.nsfocus.net/vulndb/95296
https://www.fortiguard.com/encyclopedia/ips/54513