{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/casbin/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:casbin:casdoor:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":5.9,"id":"CVE-2026-6815"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Casdoor (\u003c 3.54.1)"],"_cs_severities":["high"],"_cs_tags":["path-traversal","arbitrary-file-write","casdoor","rce","dos"],"_cs_type":"advisory","_cs_vendors":["Casbin"],"content_html":"\u003cp\u003eCasbin Casdoor versions prior to 3.54.1 contain a path traversal vulnerability in the 'Local File System' storage provider configuration. An authenticated administrator can exploit this flaw by manipulating the 'pathPrefix' and 'fullFilePath' parameters during resource upload or provider configuration. The lack of path validation allows for the writing of arbitrary files to the underlying host filesystem, which can be leveraged for Remote Code Execution (RCE) or Denial of Service (DoS). This vulnerability is confirmed to be fixed in version 3.54.1.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker gains access to a Casdoor instance with administrative privileges.\u003c/li\u003e\n\u003cli\u003eAttacker navigates to the 'Local File System' storage provider configuration page.\u003c/li\u003e\n\u003cli\u003eAttacker uses directory traversal sequences (e.g., '../') within the 'pathPrefix' parameter.\u003c/li\u003e\n\u003cli\u003eAttacker initiates a resource upload or provider update.\u003c/li\u003e\n\u003cli\u003eThe application fails to validate the resulting file path, permitting the write outside the intended storage directory.\u003c/li\u003e\n\u003cli\u003eAttacker overwrites sensitive files such as '.ssh/authorized_keys', web roots, or core application files.\u003c/li\u003e\n\u003cli\u003eAttacker triggers code execution or disrupts service.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for arbitrary file writes, resulting in Remote Code Execution (RCE) by overwriting files such as '.ssh/authorized_keys', crontabs, or web shells. Alternatively, attackers can cause a Denial of Service (DoS) by overwriting application databases or core binary files.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Casdoor to version 3.54.1 or later immediately.\u003c/li\u003e\n\u003cli\u003eAudit Casdoor administrator account activity for suspicious 'Local File System' provider configurations or modifications.\u003c/li\u003e\n\u003cli\u003eInspect application file paths and logs for unauthorized file write attempts using directory traversal sequences.\u003c/li\u003e\n\u003cli\u003eApply the Principle of Least Privilege to the system user running the Casdoor process to restrict write access to sensitive system directories.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-22T07:01:58Z","date_published":"2026-10-22T07:01:58Z","id":"https://feed.craftedsignal.io/briefs/2026-10-casdoor-path-traversal/","summary":"Casbin Casdoor versions prior to 3.54.1 are vulnerable to an authenticated path traversal vulnerability that allows attackers with administrative access to write arbitrary files to the server, leading to RCE or DoS.","title":"Casbin Casdoor: Path traversal and arbitrary file write (CVE-2026-6815)","url":"https://feed.craftedsignal.io/briefs/2026-10-casdoor-path-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - Casbin","version":"https://jsonfeed.org/version/1.1"}