MEDIUM 5.9 Go
Casdoor: Arbitrary file write possible through Local File System storage provider
GHSA-rmxx-v9rj-vpvg · CVE-2026-6815
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
An arbitrary file write vulnerability exists in Casdoor's Local File System storage provider. Due to insufficient path sanitization, an authenticated attacker with administrative privileges can perform a Path Traversal attack to create or overwrite arbitrary files anywhere on the host filesystem, bypassing the application's intended storage sandbox.
References
Ready to move
Start Securing
Free, no credit card | First findings in minutes