What is the CVSS score of CVE-2026-6815?

CVE-2026-6815 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for CVE-2026-6815?

Yes, a public proof-of-concept exploit is available for CVE-2026-6815. Prioritise patching immediately. EPSS: 0.0%.

Casdoor CVE-2026-6815

EUVD-2026-29080 MEDIUM

Path Traversal (CWE-22)

2026-05-11 certcc

GHSA-rmxx-v9rj-vpvg

Path Traversal Casdoor

5.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.9 MEDIUM

AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

May 13, 2026 - 15:59 vuln.today

CVSS changed

May 13, 2026 - 15:52 NVD

5.9 (MEDIUM)

CVE Published

May 11, 2026 - 15:20 nvd

MEDIUM 5.9

CVE Published

May 11, 2026 - 15:20 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

An arbitrary file write vulnerability exists in Casdoor's Local File System storage provider. Due to insufficient path sanitization, an authenticated attacker with administrative privileges can perform a Path Traversal attack to create or overwrite arbitrary files anywhere on the host filesystem, bypassing the application's intended storage sandbox.

AnalysisAI

Path traversal in Casdoor's Local File System storage provider allows authenticated administrators to write arbitrary files to the filesystem by bypassing path sanitization in the storage sandbox. An attacker with administrative privileges can exploit insufficient input validation to create or overwrite files anywhere on the host system. EPSS score of 0.03% indicates minimal real-world exploitation probability despite the moderate CVSS 5.9 score, suggesting the vulnerability requires both authenticated access and administrative privileges that significantly limit practical attack surface.

Technical ContextAI

Casdoor is an open-source identity and access management platform that provides pluggable storage backends, including a Local File System provider for file operations. The vulnerability exists in the Local File System storage module's path handling logic, where user-supplied file paths are not properly sanitized before filesystem operations. This allows classic path traversal techniques (e.g., '../../../') to escape the intended storage directory sandbox. The root cause is insufficient validation against directory traversal sequences in file write operations, classified under path traversal weaknesses. Casdoor versions through 2.328.0 are affected, indicating this is a historical vulnerability in the core storage abstraction layer.

RemediationAI

Upgrade Casdoor to a version newer than 2.328.0 to obtain the path sanitization fix; exact patched version not specified in available references. As an interim workaround, disable the Local File System storage provider and use alternative storage backends (e.g., S3, MinIO, or cloud storage) that are less susceptible to local path traversal, though this changes the storage architecture. Additionally, restrict Local File System storage configuration to users with strict administrative vetting, and apply OS-level filesystem permissions to limit the Casdoor process's write scope to a narrow directory with read-only parent paths to constrain traversal impact. Verify the fix in release notes at https://github.com/casdoor/casdoor/releases once patched versions are released, and test path traversal payloads in staging before production deployment.