CVE-2026-6815: Casdoor Arbitrary File Write Vulnerability in Local File System Storage Provider
Summary
CVE-2026-6815: Casdoor: Arbitrary file write possible through Local File System storage provider. Affects github.com/casdoor/casdoor versions < 1.1000.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Casdoor is an open-source identity and access management platform that provides user authentication and authorization services. It supports various storage providers, including a Local File System option for storing user data. However, the Local File System storage provider has a vulnerability that allows for arbitrary file writes due to insufficient path sanitization, which can lead to severe security issues.
Vulnerability Detail
An arbitrary file write vulnerability exists in Casdoor's Local File System storage provider. This issue arises from inadequate sanitization of file paths, allowing an authenticated attacker with administrative privileges to exploit a Path Traversal attack. By manipulating file paths, the attacker can create or overwrite files anywhere on the host filesystem, effectively bypassing the application's intended storage sandbox. This could lead to unauthorized data access, data corruption, or even system compromise.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, restrict administrative access to trusted users only and monitor file system changes closely. Additionally, consider implementing additional input validation and sanitization measures in your application to prevent path traversal attacks.
Conclusion
CVE-2026-6815 represents a significant security risk for users of Casdoor's Local File System storage provider. It is crucial to update to the latest version of the package to mitigate this vulnerability and to implement best practices for security to protect your application.
See every vulnerability recorded for github.com/casdoor/casdoor →
FAQ
CVE-2026-6815 is a vulnerability in Casdoor's Local File System storage provider that allows for arbitrary file writes due to insufficient path sanitization.
Any user of Casdoor who utilizes the Local File System storage provider and has administrative access may be affected by this vulnerability.
An attacker could exploit this vulnerability to create or overwrite files on the host filesystem, leading to unauthorized data access, data corruption, or system compromise.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score of this vulnerability is 5.9, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/casdoor/casdoor.
