Description
com/mossle/cdn/CdnController.java in lemon 1.9.0 allows attackers to upload arbitrary files because the copyMultipartFileToFile method in CdnUtils only checks for a ../ substring, and does not validate the file type and spaceName parameter.
Remediation
References
https://github.com/xuhuisheng/lemon/issues/175
Related Vulnerabilities
CVE-2021-23555 Vulnerability in npm package vm2
CVE-2019-10184 Vulnerability in maven package io.undertow:undertow-servlet
CVE-2023-37895 Vulnerability in maven package org.apache.jackrabbit:jackrabbit-standalone-components
CVE-2018-3745 Vulnerability in npm package atob
CVE-2020-14968 Vulnerability in maven package org.webjars.npm:jsrsasign