| 제목 | wwwlike vlife 1.0.3 Unrestricted Upload |
|---|
| 설명 | Vulnerability Overview
There is an unrestricted file upload flow in SysFileService#uploadImg. The service derives the stored file extension from the client-controlled multipart filename and writes the complete, unvalidated upload body to disk, , leading to Unrestricted Upload of File with Dangerous Type.
Affected Component
Project: wwwlike/vlife
Affected Files:
DataSet/CVE_Project/wwwlike_vlife_CVE-2025-13266_2.0.1/vlife-base/src/main/java/cn/wwwlike/sys/api/SysFileApi.java
DataSet/CVE_Project/wwwlike_vlife_CVE-2025-13266_2.0.1/vlife-base/src/main/java/cn/wwwlike/sys/service/SysFileService.java
Affected Endpoint:
POST /sysFile/upload
Vulnerability Details
Root Cause
The vulnerable upload implementation exists in SysFileService#uploadImg, which extracts an extension from the attacker-controlled original filename. It then writes all uploaded bytes to disk without validating that the content is an image:
public String uploadImg(MultipartFile multipartFile) {
...
String fileName = getFileName() + "." + multipartFile.getOriginalFilename().split("\\.")[1];
String pathFileName = imgPath + "/" + fileName;
FileUtil.createDir(imgPath);
...
File file = new File(pathFileName);
OutputStream out = null;
try {
out = new FileOutputStream(file);
byte[] ss = multipartFile.getBytes();
for (int i = 0; i < ss.length; i++) {
out.write(ss[i]);
}
The root causes are:
Untrusted extension extraction: The service trusts an extension derived from getOriginalFilename() and does not restrict uploads to expected image formats.
No content verification: The code does not verify MIME type, magic bytes, image decoding, or any other property of the uploaded bytes.
Attack Vector
An authenticated remote attacker can exploit the vulnerability by:
Supplying arbitrary bytes in the multipart field named file.
Giving the upload a simple filename with an arbitrary extension, such as payload.pdf.
Affected Versions
vlife ≤ 2.0.1 |
|---|
| 원천 | ⚠️ https://github.com/wwwlike/vlife/issues/6 |
|---|
| 사용자 | CyanM0un (UID 99906) |
|---|
| 제출 | 2026. 07. 17. AM 07:15 (3 개월 ago) |
|---|
| 모더레이션 | 2026. 08. 30. AM 11:58 (1 month later) |
|---|
| 상태 | 중복 |
|---|
| VulDB 항목 | 332601 [wwwlike vlife 까지 2.0.1 VLifeApi SysFileApi.java create fileName 디렉토리 순회] |
|---|
| 포인트들 | 0 |
|---|