Executive brief
DWSurvey is an open-source questionnaire and survey management system. The application fails to properly protect two API endpoint paths, allowing unauthenticated attackers to access survey data and upload files without logging in. This enables unauthorized data theft and malicious file uploads that could compromise the system.
Technical details
DWSurvey's Shiro authentication filter configuration in ShiroConfig.java explicitly defines protected paths for '/api/dwsurvey/anon/', '/api/dwsurvey/app/', and '/api/dwsurvey/admin/', but critically omits '/api/dwsurvey/none/' and '/api/dwsurvey/up/**' from any filtering rules. This authentication bypass allows unauthenticated network access to two exposed controller endpoints: DwAnswerSurveyController (serving GET /api/dwsurvey/none/v6/dw-answer-survey/survey-json-by-survey-id.do) which leaks questionnaire data, and UploadController (serving POST /api/dwsurvey/up/up-file.do) which permits arbitrary file uploads. No authentication or user interaction is required; the vulnerability is exploitable by any network-adjacent attacker with knowledge of the endpoint paths. Patches are not yet publicly available for version 6.14.0 and earlier.
Affected products
- DWSurvey DWSurvey 6.14.0 and earlier
Timeline
- 2026-08-26: disclosed