Ce mail provient de l'extérieur, restons vigilants

=====================================================================

                            CERT-Renater

                Note d'Information No. 2026/VULN480
_____________________________________________________________________

DATE                : 12/05/2026

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Casdoor.

=====================================================================
https://www.kb.cert.org/vuls/id/937808
_____________________________________________________________________


Casdoor contains Arbitrary File Write vulnerability
Vulnerability Note VU#937808
Original Release Date: 2026-05-11 | Last Revised: 2026-05-11


Overview

Casdoor contains an arbitrary file write vulnerability in the
implementation of its "Local File System" storage provider. Due to 
insufficient sanitization of user-supplied paths, an authenticated
user with file upload permissions can escape the intended storage
directory and write files elsewhere on the target filesystem. The
vulnerability allows attackers to bypass Casdoor’s storage sandbox and
perform unauthorized actions with the privileges of the Casdoor runtime
user.


Description

Casdoor is an open-source identity and access management (IAM) platform
and Model Context Protocol (MCP) gateway that provides authentication,
single sign-on, and multi-protocol identity services for applications.
Internally, it uses its Local File System storage provider to save files
to a dedicated $CASDOOR/files/ directory.

During a file upload via the /api/upload-resource endpoint, the Casdoor
application determines the target storage filepath by concatenating the
user-supplied parameters pathPrefix and fullFilePath. However, values
provided for pathPrefix are not properly sanitized, so directory traversal
sequences such as ../../ are accepted without any integrity or permission
checks beyond those of the OS user running the Casdoor process. The
application does not verify that the destination filepath remains inside
the dedicated storage directory, and it will create or overwrite any file
that the Casdoor process has permission to modify.

CVE-2026-6815 An arbitrary file write vulnerability exists in Casdoor's
Local File System storage provider. Due to insufficient path sanitization,
an authenticated attacker with file upload privileges can perform a path
traversal attack to create or overwrite arbitrary files elsewhere on the
host filesystem, bypassing the application's intended storage sandbox.


Impact

Successful exploitation enables arbitrary file creation and modification
on the host system, which can be used by an attacker to:
* Overwrite any file that is accessible to the Casdoor process.
* Establish persistence by creating scheduled tasks or cron jobs through
the filesystem as the Casdoor user.
* Overwrite Casdoor’s backend database file casdoor.db, causing authentication
services to fail and locking out all users and dependent applications.

Exploitation of this vulnerability requires the attacker to possess an
authenticated session with sufficient permissions to manage storage
providers and interact with the resource upload API. Depending on the
privileges of the Casdoor service account, this vulnerability may allow
escalation from application-level access to full host compromise.


Solution

A pull request has been submitted to the Casdoor repository that implements
proper validation of storage paths, available here:
https://github.com/casdoor/casdoor/pull/5458 . Otherwise, deployments should
limit administrative access and restrict the filesystem permissions of the
Casdoor service account. Administrators should avoid using the Local File
System provider or disable this service in multi-user or exposed environments.


Acknowledgements

Thanks to Danilo Dell'Orco for researching and reporting this vulnerability.
This document was written by Molly Jaconski.


Vendor Information

Casdoor Unknown

Other Information
CVE IDs: 	CVE-2026-6815
API URL: 	VINCE JSON | CSAF
Date Public: 	2026-05-11
Date First Published: 	2026-05-11
Date Last Updated: 	2026-05-11 14:48 UTC
Document Revision: 	2 


=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================