Skip to main content

CISA issues update for Casdoor arbitrary file write vulnerability

Source Decision Insights Threat Desk Published May 11, 2026 Companies 1
Human View Machine View

24th article in the last 90 days, one of 540 articles referencing Cybersecurity and Infrastructure Security Agency (CISA). Previous coverage: CISA issues update on dnsmasq vulnerabilities enabling DoS and code execution (May 2026).

Companies mentioned

Best suited for

Seniority
Director
Job function
Cybersecurity / Security Operations
Persona
Security Operations Leader
Buyer role
Technical Implementer / Administrator
Decision stage
Which to buy
Adoption curve
Late Majority
Technology maturity
Established Technology
Industry
Information Technology / Software & Services / IT Services / Internet Services & Infrastructure

Our classification, not the publisher's statement. Best suited for, not only for.

Casdoor has an arbitrary file write issue in its “Local File System” storage provider. The flaw can let an authenticated user with file upload permissions write outside the intended storage directory, enabling arbitrary file creation and modification with the privileges of the Casdoor runtime user.

The Local File System storage provider saves files to the dedicated $CASDOOR/files/ directory. During a file upload via the /api/upload-resource endpoint, Casdoor determines the target storage filepath by concatenating the user-supplied parameters pathPrefix and fullFilePath. Values provided for pathPrefix are not properly sanitized, so directory traversal sequences such as ../../ are accepted without any integrity or permission checks beyond those of the OS user running the Casdoor process. The application does not verify that the destination filepath remains inside the dedicated storage directory, and it will create or overwrite any file that the Casdoor process has permission to modify. CVE-2026-6815 is the identifier for this arbitrary file write vulnerability, which results from insufficient path sanitization and enables a path traversal attack to create or overwrite arbitrary files elsewhere on the host filesystem.

Successful exploitation enables arbitrary file creation and modification on the host system for actions that include overwriting any file accessible to the Casdoor process, establishing persistence by creating scheduled tasks or cron jobs through the filesystem as the Casdoor user, and overwriting Casdoor’s backend database file casdoor.db, causing authentication services to fail and locking out all users and dependent applications.

Exploitation requires an authenticated session with sufficient permissions to manage storage providers and interact with the resource upload API. Depending on the privileges of the Casdoor service account, the vulnerability may allow escalation from application-level access to full host compromise. A pull request has been submitted to the Casdoor repository that implements proper validation of storage paths (https://github.com/casdoor/casdoor/pull/5458).

The published guidance states that deployments should limit administrative access and restrict the filesystem permissions of the Casdoor service account. Administrators should avoid using the Local File System provider or disable this service in multi-user or exposed environments.

Blog post, originally published at kb.cert.org.

Mentions

Structured data (JSON-LD)

The schema.org markup this page publishes for search engines and AI agents, exactly as they read it.

[
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#website",
    "@type": "WebSite",
    "name": "Decision Insights",
    "potentialAction": {
      "@type": "SearchAction",
      "target": {
        "@type": "EntryPoint",
        "urlTemplate": "https://decisioninsights.ai/search/?q={search_term_string}&submit=1"
      }
    },
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    },
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#organization",
    "@type": "Organization",
    "contactPoint": {
      "@type": "ContactPoint",
      "contactType": "customer support",
      "email": "[email protected]"
    },
    "description": "Decision Insights is a Registry of technology companies, open source projects, and industry terms, built for people and for AI agents that need sourced, structured information.",
    "logo": {
      "@type": "ImageObject",
      "url": "https://wiretap-cdn-assets.nyc3.cdn.digitaloceanspaces.com/decision-insights/[email protected]"
    },
    "name": "Decision Insights",
    "parentOrganization": {
      "@type": "Organization",
      "name": "Wiretap Labs",
      "sameAs": [
        "https://www.linkedin.com/company/wiretap-labs",
        "https://www.crunchbase.com/organization/wiretap-labs"
      ],
      "url": "https://wiretaplabs.com"
    },
    "publishingPrinciples": "https://decisioninsights.ai/standards/",
    "sameAs": [
      "https://www.linkedin.com/company/decisioninsights"
    ],
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai",
        "name": "Decision Insights",
        "position": 1
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/records/",
        "name": "Records",
        "position": 2
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/cisa-issues-update-for-casdoor-arbitrary-file-write-vulnerability/",
        "name": "CISA issues update for Casdoor arbitrary file write vulnerability",
        "position": 3
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/cisa-issues-update-for-casdoor-arbitrary-file-write-vulnerability/#blogposting",
    "@type": "BlogPosting",
    "about": {
      "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/#organization",
      "@type": "Organization",
      "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/",
      "name": "Cybersecurity and Infrastructure Security Agency (CISA)"
    },
    "articleSection": [
      "Storage",
      "Cybersecurity"
    ],
    "audience": [
      {
        "@type": "Audience",
        "additionalType": "Seniority",
        "audienceType": "Director"
      },
      {
        "@type": "Audience",
        "additionalType": "Job function",
        "audienceType": "Cybersecurity / Security Operations"
      },
      {
        "@type": "Audience",
        "additionalType": "Persona",
        "audienceType": "Security Operations Leader"
      },
      {
        "@type": "Audience",
        "additionalType": "Buyer role",
        "audienceType": "Technical Implementer / Administrator"
      },
      {
        "@type": "Audience",
        "additionalType": "Adoption curve",
        "audienceType": "Late Majority"
      },
      {
        "@type": "Audience",
        "additionalType": "Technology maturity",
        "audienceType": "Established Technology"
      },
      {
        "@type": "Audience",
        "additionalType": "Industry",
        "audienceType": "Information Technology / Software & Services / IT Services / Internet Services & Infrastructure"
      }
    ],
    "author": {
      "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
      "@type": "Person",
      "name": "Decision Insights Threat Desk",
      "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
    },
    "dateModified": "2026-08-23T13:09:31-06:00",
    "datePublished": "2026-05-11T12:03:01-06:00",
    "description": "CISA: Casdoor arbitrary file write vulnerability CVE-2026-6815 in Local File System provider via /api/upload-resource and pathPrefix traversal.",
    "headline": "CISA issues update for Casdoor arbitrary file write vulnerability",
    "isBasedOn": {
      "@type": "CreativeWork",
      "sourceOrganization": {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/",
        "name": "Department of Homeland Security"
      },
      "url": "https://kb.cert.org/vuls/id/937808"
    },
    "keywords": [
      "Service Account",
      "Vulnerabilities"
    ],
    "mainEntityOfPage": {
      "@id": "https://decisioninsights.ai/cisa-issues-update-for-casdoor-arbitrary-file-write-vulnerability/",
      "@type": "WebPage",
      "sdDatePublished": "2026-08-23",
      "sdPublisher": {
        "@id": "https://decisioninsights.ai/#organization"
      }
    },
    "mentions": [
      {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/",
        "name": "Cybersecurity and Infrastructure Security Agency (CISA)"
      },
      {
        "@id": "https://decisioninsights.ai/projects/casdoor/#project",
        "@type": "SoftwareSourceCode",
        "mainEntityOfPage": "https://decisioninsights.ai/projects/casdoor/",
        "name": "Casdoor"
      }
    ],
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    }
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
    "@type": "Person",
    "description": "CISA advisories, vendor security bulletins, and CVE disclosures, summarized into sourced briefs. Produced under our Standards & Methodology.",
    "name": "Decision Insights Threat Desk",
    "sameAs": [
      "https://www.linkedin.com/showcase/decisioninsights/"
    ],
    "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
  }
]

Is this your company? Get structured data for your own pages