Casdoor arbitrary file write vulnerability

CRITICAL 9.1CVE-2022-38638 · GHSA-9vm3-r8gq-cr6x · GO-2022-1006 · Published 09/09/2022 · updated 17/06/2026

In short

CVE-2022-38638 is a CRITICAL (CVSS 9.1) vulnerability affecting github.com/casdoor/casdoor, casdoor, casdoor (casbin).
Chance of exploitation in the next 30 days (EPSS): 1.2%, higher than 68.8% of all vulnerabilities.
Fix: update to 1.103.1 or later.

Package	Affected versions	Patched versions
github.com/casdoor/casdoor Go	`< 1.103.1`	`1.103.1`
casdoor PyPI	`≤ 1.97.3`	No fix yet
casdoor casbin	`= 1.97.3`	No fix yet

Casdoor v1.97.3 was discovered to contain an arbitrary file write vulnerability via the fullFilePath parameter at /api/upload-resource.

NVD description

Casdoor v1.97.3 was discovered to contain an arbitrary file write vulnerability via the fullFilePath parameter at /api/upload-resource.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

< 1.103.1

1.103.1

PyPI

≤ 1.97.3

No fix yet

= 1.97.3

No fix yet

More vulnerabilities in github.com/casdoor/casdoor

See all →