CVE-2018-18315 | BDVDB-2026-108262 Detail

Description#

com/mossle/cdn/CdnController.java in lemon 1.9.0 allows attackers to upload arbitrary files because the copyMultipartFileToFile method in CdnUtils only checks for a ../ substring, and does not validate the file type and spaceName parameter.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://github.com/xuhuisheng/lemon/issues/175

Exploit#

No public exploit known

History#

Version 12018-10-15Record published in the CVE List.
Version 22024-08-05Most recent update recorded in the CVE List.