CVE-2026-6815

5.9 MEDIUM

An arbitrary file write vulnerability exists in Casdoor's Local File System storage provider

Published: 2026-05-11 · Last updated: 2026-06-01

Severity and scoring

CVSS: 5.9 MEDIUM
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CWE: CWE-22

Affected products

Vendor	Product
casbin	casdoor

Description

An arbitrary file write vulnerability exists in Casdoor's Local File System storage provider. Due to insufficient path sanitization, an authenticated attacker with administrative privileges can perform a Path Traversal attack to create or overwrite arbitrary files anywhere on the host filesystem, bypassing the application's intended storage sandbox.

Source: NVD

References

[NVD]https://nvd.nist.gov/vuln/detail/CVE-2026-6815
[Other]https://kb.cert.org/vuls/id/937808
[Other]https://www.kb.cert.org/vuls/id/937808

Related CVEs

Same CWE

CVE-2026-48777 — FileBrowser Quantum is a free, self-hosted, web-based file manager
CVE-2026-8442 — The WP Review Slider Pro plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to and including 12.6.8 (8.1 HIGH)
CVE-2026-49766 — Subscriber Arbitrary File Deletion in WP User Manager <= 2.9.16 versions (9.9 CRITICAL)
CVE-2026-49061 — Unauthenticated Arbitrary File Download in WPC Product Options for WooCommerce <= 3.2.1 versions (7.5 HIGH)
CVE-2026-40779 — Contributor Arbitrary File Deletion in Link Library <= 7.8.8 versions (7.7 HIGH)