Path Traversal Vulnerability in nitroshare

Description

NitroShare Desktop v0.3.4 contains a path traversal vulnerability in its LAN file transfer server. The server listens on all network interfaces (port 40818) without authentication. When receiving files, the name field from the sender's JSON item header is passed without verifying the resolved path stays within the transfer root directory, C:\UserName\Downloads\NitroShare. An attacker on the same LAN can send a crafted filename containing ../ (classic dot dot slash attack) sequences to write files anywhere the current user has access, including the Windows Startup folder for code execution on next login (hence the POC that was created). No user interaction is required. Additionally, TLS is disabled by default (the method of authentication that the application offers), meaning that no authentication is required by default, which I assume most users will do based on years working in IT and Information Securtiy.

Steps to Reproduce

1. Connect to NitroShare's transfer server on TCP port 40818 from the LAN.
2. Send a JSON transfer header packet: {"name":"attacker","size":"<n>","count":"1"}.
3. Send a JSON item header packet with a path traversal filename:
   root@kitploit:~

   {"name":"../../AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Startup/payload.exe","directory":false,"created":"0","last_modified":"0","last_read":"0","size":"<n>"}