WS-2026-0031

NocoBase is vulnerable to authenticated remote code execution through two chained flaws in the server package. An authenticated admin can supply an unsanitized documentRoot value to the storages:update API to redirect the file-upload storage root to an arbitrary path on disk, including the...

GHSA-GHVF-QF6H-G8X5 NocoBase: Arbitrary File Write chained with Local file Inclusion leads to Remote code execution

Executive Summary Two vulnerabilities were identified and chained to achieve authenticated remote code execution The first vulnerability allows any authenticated admin to redirect the file upload storage root to an arbitrary path on disk including the application directory itself by supplying an...

PT-2026-83653

Executive Summary Two vulnerabilities were identified and chained to achieve authenticated remote code execution The first vulnerability allows any authenticated admin to redirect the file upload storage root to an arbitrary path on disk including the application directory itself by supplying an...