CVE-2018-18315

Published: 2018-10-15T04:29Z

Last Modified: 2024-11-21T03:55Z

Source: MITRE CVE List

License: MITRE-CVE-TOS

com/mossle/cdn/CdnController.java in lemon 1.9.0 allows attackers to upload arbitrary files because the copyMultipartFileToFile method in CdnUtils only checks for a ../ substring, and does not validate the file type and spaceName parameter. > MITRE Terms of Use apply – see LICENSE‑MITRE.txt