GitHub Advisoryadvisory · Go

GHSA-rmxx-v9rj-vpvg Casdoor: Arbitrary file write possible through Local File System storage provider

MEDIUM Published 2026-05-11 Modified 2026-07-08 Official page ↗
Aliases
CVE-2026-6815
Ecosystem
Go
Packages
github.com/casdoor/casdoor
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-22
Reviewed
2026-07-08

Affected packages

• Go github.com/casdoor/casdoor: <= 1.1000.0 (no fix yet)

Description

An arbitrary file write vulnerability exists in Casdoor's Local File System storage provider. Due to insufficient path sanitization, an authenticated attacker with administrative privileges can perform a Path Traversal attack to create or overwrite arbitrary files anywhere on the host filesystem, bypassing the application's intended storage sandbox.

Related

Alias · CVE (1)

  • CVE-2026-6815 An arbitrary file write vulnerability exists in Casdoor's Local File System storage provider. vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References