Description
com/mossle/cdn/CdnController.java in lemon 1.9.0 allows attackers to upload arbitrary files because the copyMultipartFileToFile method in CdnUtils only checks for a ../ substring, and does not validate the file type and spaceName parameter.
Remediation
References
https://github.com/xuhuisheng/lemon/issues/175
Related Vulnerabilities
CVE-2020-2242 Vulnerability in maven package org.jenkins-ci.plugins:database
CVE-2021-32822 Vulnerability in npm package hbs
CVE-2020-5222 Vulnerability in maven package org.opencastproject:opencast-kernel
CVE-2020-6836 Vulnerability in npm package hot-formula-parser
CVE-2020-26939 Vulnerability in maven package org.bouncycastle:bcprov-ext-jdk14