| Package | Affected versions | Patched versions |
|---|---|---|
| lemon | = 1.9.0 |
com/mossle/cdn/CdnController.java in lemon 1.9.0 allows attackers to upload arbitrary files because the copyMultipartFileToFile method in CdnUtils only checks for a ../ substring, and does not validate the file type and spaceName parameter.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free