GHSA-rmxx-v9rj-vpvg

Source

https://github.com/advisories/GHSA-rmxx-v9rj-vpvg

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-rmxx-v9rj-vpvg/GHSA-rmxx-v9rj-vpvg.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-rmxx-v9rj-vpvg

Aliases

Published

2026-05-11T18:31:44Z

Modified

2026-07-21T19:19:17Z

Severity

5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CVSS Calculator

Summary

Casdoor: Arbitrary file write possible through Local File System storage provider

Details

An arbitrary file write vulnerability exists in Casdoor's Local File System storage provider. Due to insufficient path sanitization, an authenticated attacker with administrative privileges can perform a Path Traversal attack to create or overwrite arbitrary files anywhere on the host filesystem, bypassing the application's intended storage sandbox.

Database specific

{
    "cwe_ids":  [
        "CWE-22"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-07-08T21:00:22Z",
    "nvd_published_at":  "2026-05-11T16:17:37Z",
    "severity":  "MODERATE"
}

References

Affected packages

Go / github.com/casdoor/casdoor

Package

Name: github.com/casdoor/casdoor; View open source insights on deps.dev
Purl: pkg:golang/github.com/casdoor/casdoor

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

1.1000.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-rmxx-v9rj-vpvg/GHSA-rmxx-v9rj-vpvg.json"