CVE-2018-18315

2018-10-1504:29:01

Google

osv.dev

AI Score

Confidence

High

EPSS

0.001

Percentile

28.7%

JSON

com/mossle/cdn/CdnController.java in lemon 1.9.0 allows attackers to upload arbitrary files because the copyMultipartFileToFile method in CdnUtils only checks for a …/ substring, and does not validate the file type and spaceName parameter.

References

github.com/xuhuisheng/lemon/issues/175