Description
com/mossle/cdn/CdnController.java in lemon 1.9.0 allows attackers to upload arbitrary files because the copyMultipartFileToFile method in CdnUtils only checks for a ../ substring, and does not validate the file type and spaceName parameter.
Remediation
References
https://github.com/xuhuisheng/lemon/issues/175
Related Vulnerabilities
CVE-2017-16039 Vulnerability in npm package hftp
CVE-2018-14718 Vulnerability in maven package com.fasterxml.jackson.core:jackson-databind
CVE-2020-7662 Vulnerability in npm package websocket-extensions
CVE-2019-10744 Vulnerability in maven package org.webjars.npm:lodash
CVE-2019-10404 Vulnerability in maven package org.jenkins-ci.main:jenkins-core