Description
com/mossle/cdn/CdnController.java in lemon 1.9.0 allows attackers to upload arbitrary files because the copyMultipartFileToFile method in CdnUtils only checks for a ../ substring, and does not validate the file type and spaceName parameter.
Remediation
References
https://github.com/xuhuisheng/lemon/issues/175
Related Vulnerabilities
CVE-2022-40151 Vulnerability in maven package com.thoughtworks.xstream:xstream
CVE-2019-1003086 Vulnerability in maven package org.jenkins-ci.plugins:sinatra-chef-builder
CVE-2019-19771 Vulnerability in npm package bitcoimd-rpc
CVE-2021-27807 Vulnerability in maven package org.apache.pdfbox:pdfbox
CVE-2022-0673 Vulnerability in maven package org.eclipse.lemminx:lemminx-parent