CVE-2026-6815: Casdoor: Arbitrary file write possible through Local File System storage provider

May 11, 2026 (updated July 8, 2026)

An arbitrary file write vulnerability exists in Casdoor’s Local File System storage provider. Due to insufficient path sanitization, an authenticated attacker with administrative privileges can perform a Path Traversal attack to create or overwrite arbitrary files anywhere on the host filesystem, bypassing the application’s intended storage sandbox.

References

github.com/advisories/GHSA-rmxx-v9rj-vpvg
kb.cert.org/vuls/id/937808
nvd.nist.gov/vuln/detail/CVE-2026-6815
www.kb.cert.org/vuls/id/937808

Code Behaviors & Features

Detect and mitigate CVE-2026-6815 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →