There is an arbitrary file deletion vulnerability in src/main/java/com/wuhao/wuhaozn_springboot/portal_control/slideshow_control.java and src/main/java/com/wuhao/wuhaozn_springboot/util/delete_slideshow.java

[liyunqiangs]

The file path returned by the front end was not filtered.

Delete the file directly using the file name returned by the front end.

File deletion test:
Frist, create the file named "test.txt".

Then,send a request to access '/delete_slideshow' and specify the deletion of the file as the target file.

The target file has been deleted and the attack was successful.