Arbitrary File Write Vulnerability in Casdoor's Local File System Storage Provider

CVE-2026-6815

What is CVE-2026-6815?

The arbitrary file write vulnerability in Casdoor's Local File System storage provider is caused by insufficient path sanitization. An authenticated attacker with administrative privileges can exploit this vulnerability to perform a Path Traversal attack, allowing them to create or overwrite files anywhere on the host filesystem. This defect undermines the application's intended storage sandbox, potentially leading to unauthorized access and manipulation of critical files.

References