| Название | wwwlike vlife 1.0.3 Unrestricted Upload |
|---|
| Описание | Vulnerability Overview
There is an unrestricted file upload flow in SysFileService#uploadImg. The service derives the stored file extension from the client-controlled multipart filename and writes the complete, unvalidated upload body to disk, , leading to Unrestricted Upload of File with Dangerous Type.
Affected Component
Project: wwwlike/vlife
Affected Files:
DataSet/CVE_Project/wwwlike_vlife_CVE-2025-13266_2.0.1/vlife-base/src/main/java/cn/wwwlike/sys/api/SysFileApi.java
DataSet/CVE_Project/wwwlike_vlife_CVE-2025-13266_2.0.1/vlife-base/src/main/java/cn/wwwlike/sys/service/SysFileService.java
Affected Endpoint:
POST /sysFile/upload
Vulnerability Details
Root Cause
The vulnerable upload implementation exists in SysFileService#uploadImg, which extracts an extension from the attacker-controlled original filename. It then writes all uploaded bytes to disk without validating that the content is an image:
public String uploadImg(MultipartFile multipartFile) {
...
String fileName = getFileName() + "." + multipartFile.getOriginalFilename().split("\\.")[1];
String pathFileName = imgPath + "/" + fileName;
FileUtil.createDir(imgPath);
...
File file = new File(pathFileName);
OutputStream out = null;
try {
out = new FileOutputStream(file);
byte[] ss = multipartFile.getBytes();
for (int i = 0; i < ss.length; i++) {
out.write(ss[i]);
}
The root causes are:
Untrusted extension extraction: The service trusts an extension derived from getOriginalFilename() and does not restrict uploads to expected image formats.
No content verification: The code does not verify MIME type, magic bytes, image decoding, or any other property of the uploaded bytes.
Attack Vector
An authenticated remote attacker can exploit the vulnerability by:
Supplying arbitrary bytes in the multipart field named file.
Giving the upload a simple filename with an arbitrary extension, such as payload.pdf.
Affected Versions
vlife ≤ 2.0.1 |
|---|
| Источник | ⚠️ https://github.com/wwwlike/vlife/issues/6 |
|---|
| Пользователь | CyanM0un (UID 99906) |
|---|
| Представление | 17.07.2026 07:15 (3 месяцы назад) |
|---|
| Модерация | 30.08.2026 11:58 (1 month later) |
|---|
| Статус | Дубликат |
|---|
| Запись VulDB | 332601 [wwwlike vlife до 2.0.1 VLifeApi SysFileApi.java create fileName обход каталога] |
|---|
| Баллы | 0 |
|---|