Executive brief
Casdoor is an identity management platform used to handle user logins and authentication for various applications. A security flaw in its local storage system allows an authorized user with file upload permissions to save files outside of the intended folder. This could allow an attacker to overwrite critical system files, potentially leading to a complete service outage or unauthorized access to the underlying server.
Technical details
A path traversal vulnerability (CWE-22) exists in Casdoor's Local File System storage provider within the /api/upload-resource endpoint. The application fails to sanitize the 'pathPrefix' and 'fullFilePath' parameters, allowing an authenticated attacker with file upload privileges to use directory traversal sequences (e.g., ../../) to write or overwrite files outside the designated $CASDOOR/files/ directory. This can result in the corruption of the backend database (casdoor.db), persistence via cron job creation, or full host compromise depending on the service account's permissions. While a pull request (PR #5458) has been submitted to address the issue, no official patched version was confirmed at the time of the advisory.
Affected products
- Casdoor Casdoor <= 1.1000.0
Timeline
- 2026-02-23: other: Vendor notified
- 2026-05-11: disclosed: Initial public disclosure
- 2026-05-11: advisory: GitHub Advisory published