Executive brief
NocoBase is a low-code database and content management platform. Two chained vulnerabilities in the file manager and plugin system allow an authenticated administrator to upload malicious code to arbitrary filesystem locations and then execute it as the application server, leading to complete system compromise. The attack requires only valid admin credentials and can bypass all access controls to execute arbitrary commands.
Technical details
Two separate vulnerabilities are chained together. Vulnerability 1 (arbitrary file write): The `storages:update` API endpoint accepts an unsanitized `documentRoot` parameter in the file-manager plugin, allowing authenticated admins to redirect file upload storage to any filesystem path including the application root directory. The `getDocumentRoot()` function in `packages/plugins/@nocobase/plugin-file-manager/src/server/storages/local.ts` does not validate the `documentRoot` value; it only calls `resolveSafePath()` which provides filename traversal protection but uses the attacker-controlled root as its base. Vulnerability 2 (local file inclusion / RCE): The `pm:enable` plugin manager endpoint in `packages/core/server/src/plugin-manager/options/resource.ts` accepts a `filterByTk` parameter from query strings and passes it directly to Node.js `require()` without validation. The `requireModule()` function executes arbitrary files as Node.js modules, and although `assertSafePluginPackageName()` exists in the codebase to validate paths, it is never invoked in the HTTP action handler. An attacker chains these by: (1) using `storages:update` to set `documentRoot` to the application's current working directory, (2) uploading a malicious JavaScript file via `attachments:upload`, and (3) triggering execution via `pm:enable` with the path to the uploaded payload. Both endpoints require authentication (admin session token), but no additional privileges or user interaction is needed. Patch version 2.1.5 addresses both issues.
Affected products
- NocoBase @nocobase/server < 2.1.5
Timeline
- 2026-06-15: disclosed
- 2026-06-15: patched: Version 2.1.5 released
- 2026-08-20: advisory