CVE-2024-56828

ChestnutCMS versions prior to 1.5.0 are vulnerable to a file upload flaw in the /api/member/avatar API endpoint. The memberService.uploadAvatarByBase64 method accepts a base64 string, extracts the content, and writes it to a file without validating the file extension derived from the suffix varia...