| عنوان | wwwlike vlife 1.0.3 Unrestricted Upload |
|---|
| الوصف | Vulnerability Overview
There is an unrestricted file upload flow in SysFileService#uploadImg. The service derives the stored file extension from the client-controlled multipart filename and writes the complete, unvalidated upload body to disk, , leading to Unrestricted Upload of File with Dangerous Type.
Affected Component
Project: wwwlike/vlife
Affected Files:
DataSet/CVE_Project/wwwlike_vlife_CVE-2025-13266_2.0.1/vlife-base/src/main/java/cn/wwwlike/sys/api/SysFileApi.java
DataSet/CVE_Project/wwwlike_vlife_CVE-2025-13266_2.0.1/vlife-base/src/main/java/cn/wwwlike/sys/service/SysFileService.java
Affected Endpoint:
POST /sysFile/upload
Vulnerability Details
Root Cause
The vulnerable upload implementation exists in SysFileService#uploadImg, which extracts an extension from the attacker-controlled original filename. It then writes all uploaded bytes to disk without validating that the content is an image:
public String uploadImg(MultipartFile multipartFile) {
...
String fileName = getFileName() + "." + multipartFile.getOriginalFilename().split("\\.")[1];
String pathFileName = imgPath + "/" + fileName;
FileUtil.createDir(imgPath);
...
File file = new File(pathFileName);
OutputStream out = null;
try {
out = new FileOutputStream(file);
byte[] ss = multipartFile.getBytes();
for (int i = 0; i < ss.length; i++) {
out.write(ss[i]);
}
The root causes are:
Untrusted extension extraction: The service trusts an extension derived from getOriginalFilename() and does not restrict uploads to expected image formats.
No content verification: The code does not verify MIME type, magic bytes, image decoding, or any other property of the uploaded bytes.
Attack Vector
An authenticated remote attacker can exploit the vulnerability by:
Supplying arbitrary bytes in the multipart field named file.
Giving the upload a simple filename with an arbitrary extension, such as payload.pdf.
Affected Versions
vlife ≤ 2.0.1 |
|---|
| المصدر | ⚠️ https://github.com/wwwlike/vlife/issues/6 |
|---|
| المستخدم | CyanM0un (UID 99906) |
|---|
| ارسال | 17/07/2026 07:15 AM (3 أشهر منذ) |
|---|
| الاعتدال | 30/08/2026 11:58 AM (1 month later) |
|---|
| الحالة | مكرر |
|---|
| إدخال VulDB | 332601 [wwwlike vlife حتى 2.0.1 VLifeApi SysFileApi.java create fileName اجتياز الدليل] |
|---|
| النقاط | 0 |
|---|