Casdoor EUVD-2026-29080

Exploitation requires the Local File System storage provider to be actively configured and used in Casdoor's storage chain. The attacker must possess valid administrative credentials to access file upload or storage configuration endpoints. The attack is limited to local filesystem scope - the vulnerability does not enable remote file system access or escape the host operating system boundary. Non-default storage configurations (e.g., cloud storage backends) are not affected. The CVSS vector states PR:N (no privilege requirement), but the description explicitly requires administrative privileges; this conflict indicates the path traversal itself may be unauthenticated-accessible in certain code paths, but full impact requires admin context. Filesystem permissions on the host (e.g., if Casdoor runs as an unprivileged user) may further restrict where files can be written, limiting impact even if the vulnerability is exploited.

The CVSS 5.9 score reflects a local attack vector (AV:L) with no authentication required in the vector definition (PR:N), creating apparent conflation with the description stating 'authenticated attacker with administrative privileges.' The actual risk is substantially lower than the CVSS suggests: EPSS 0.03% (percentile 9%) indicates this is in the lowest exploitation probability tier, consistent with the high barrier of requiring both valid administrative credentials AND local filesystem access. The vulnerability is not in CISA KEV and no public exploit code has been identified, further reducing real-world risk. This appears to be a theoretical path traversal in an administrative-only feature rather than a broadly exploitable flaw. The discrepancy between CVSS vector (PR:N) and description (PR requiring admin) suggests either CVSS vector inaccuracy or that the administrator context is a deployment-specific condition rather than a technical requirement. Organizations with strong administrative access controls and filesystem permissions will see minimal practical risk.

An internal administrator with legitimate access to Casdoor's administrative console exploits insufficient path sanitization in the Local File System storage upload feature by providing a crafted file path containing '../' sequences. The attacker uploads a malicious configuration file or script to a location outside the intended storage directory (e.g., application webroot or system directories), then triggers execution of the planted file through a separate Casdoor function or direct filesystem access, achieving code execution or configuration compromise.