Description
com/mossle/cdn/CdnController.java in lemon 1.9.0 allows attackers to upload arbitrary files because the copyMultipartFileToFile method in CdnUtils only checks for a ../ substring, and does not validate the file type and spaceName parameter.
Remediation
References
https://github.com/xuhuisheng/lemon/issues/175
Related Vulnerabilities
CVE-2018-1272 Vulnerability in maven package org.springframework:spring-webmvc
CVE-2019-15600 Vulnerability in npm package http_server
CVE-2019-10435 Vulnerability in maven package org.jenkins-ci.plugins:vault-scm-plugin
CVE-2018-14042 Vulnerability in maven package org.webjars.bower:bootstrap-sass
CVE-2018-16131 Vulnerability in maven package com.typesafe.akka:akka-http-core_2.12