Casbin Casdoor: Path traversal and arbitrary file write (CVE-2026-6815)

Casbin Casdoor versions prior to 3.54.1 contain a path traversal vulnerability in the 'Local File System' storage provider configuration. An authenticated administrator can exploit this flaw by manipulating the 'pathPrefix' and 'fullFilePath' parameters during resource upload or provider configuration. The lack of path validation allows for the writing of arbitrary files to the underlying host filesystem, which can be leveraged for Remote Code Execution (RCE) or Denial of Service (DoS). This vulnerability is confirmed to be fixed in version 3.54.1.

Attack Chain

1. Attacker gains access to a Casdoor instance with administrative privileges.
2. Attacker navigates to the 'Local File System' storage provider configuration page.
3. Attacker uses directory traversal sequences (e.g., '../') within the 'pathPrefix' parameter.
4. Attacker initiates a resource upload or provider update.
5. The application fails to validate the resulting file path, permitting the write outside the intended storage directory.
6. Attacker overwrites sensitive files such as '.ssh/authorized_keys', web roots, or core application files.
7. Attacker triggers code execution or disrupts service.

Impact

Successful exploitation allows for arbitrary file writes, resulting in Remote Code Execution (RCE) by overwriting files such as '.ssh/authorized_keys', crontabs, or web shells. Alternatively, attackers can cause a Denial of Service (DoS) by overwriting application databases or core binary files.

Recommendation

• Upgrade Casdoor to version 3.54.1 or later immediately.
• Audit Casdoor administrator account activity for suspicious 'Local File System' provider configurations or modifications.
• Inspect application file paths and logs for unauthorized file write attempts using directory traversal sequences.
• Apply the Principle of Least Privilege to the system user running the Casdoor process to restrict write access to sensitive system directories.