Casdoor arbitrary file write vulnerability

CRÍTICO 9.1CVE-2022-38638 · GHSA-9vm3-r8gq-cr6x · GO-2022-1006 · Published 09/09/2022 · updated 17/06/2026

En resumen

CVE-2022-38638 es una vulnerabilidad CRÍTICO (CVSS 9.1) que afecta a github.com/casdoor/casdoor, casdoor, casdoor (casbin).
Probabilidad de explotación en los próximos 30 días (EPSS): 1.2%, mayor que el 68.8% de las vulnerabilidades.
Solución: actualizar a 1.103.1 o posterior.

Package	Affected versions	Patched versions
github.com/casdoor/casdoor Go	`< 1.103.1`	`1.103.1`
casdoor PyPI	`≤ 1.97.3`	No fix yet
casdoor casbin	`= 1.97.3`	No fix yet

Casdoor v1.97.3 was discovered to contain an arbitrary file write vulnerability via the fullFilePath parameter at /api/upload-resource.

NVD description

Casdoor v1.97.3 was discovered to contain an arbitrary file write vulnerability via the fullFilePath parameter at /api/upload-resource.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

< 1.103.1

1.103.1

PyPI

≤ 1.97.3

No fix yet

= 1.97.3

No fix yet

Más vulnerabilidades de github.com/casdoor/casdoor

Ver todo →