[Bug] FTP Path Traversal Vulnerability

[AkaiEurus]

Describe the bug

Crafting specific paths (e.g., ../../) can bypass the restrictions of the FTP mount directory.

To Reproduce

The working directory is /home/user/rootfs, and a file 'flag' exists in the /home/user directory. Running the following commands can get the flag.

$ python mavftp.py --device tcp:127.0.0.1:5760 get ../flag flag

Expected behavior

Cannot access the parent directory of the mounted directory.

Screenshot / Media

Flight Log

No response

Software Version

No response

Flight controller

No response

Vehicle type

None

How are the different components wired up (including port information)

No response

Additional context

No response