| Title | gouguoa 6.1.2 Remote Code Execution via Unrestricted File Extension Upload |
|---|
| Description | GouguOA v6.1.2 (ThinkPHP 8 based open-source office system, https://gitee.com/gouguopen/office, vendor site https://www.gouguoa.com) allows any authenticated low-privilege user (a regular employee with the default seeded role) to achieve remote code execution through the chunked file upload feature.
The handler app/disk/controller/Api.php chunkUpload() (line 212-337, endpoint POST /disk/api/chunkUpload) applies its extension whitelist only to the individual chunk parts. The extension of the MERGED output file is taken verbatim from the user-supplied "file_extension" POST parameter with no validation. The merge code at line 274 is: md5(file_id.file_name).".".file_extension, and the result is written into the web-accessble public/storage/{Ym}/ directory. Uploading PHP payload as an ordinary .txt chunk and merging with file_extension=php creates an executable webshell under the web root.
The HTTP 500 response does not prevent exploitation: it is caused by a call to an undefined function get_login_admin() that occurs AFTER the payload file has been written to disk. The output filename is the md5 of two attacker-chosen inputs and can be computed offline.
Verified on a default installation: arbitrary PHP code execution in the web server context |
|---|
| Source | ⚠️ https://github.com/Gum29/rrrreeeeeeee-readme/blob/main/images/img/GouguOA-RCE-Standard-Vuln-Report-EN.md |
|---|
| User | 92973383 (UID 101691) |
|---|
| Submission | 09/28/2026 11:06 (27 days ago) |
|---|
| Moderation | 10/25/2026 09:35 (27 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 426181 [GouGuOA up to 6.1.2 Api.php chunkUpload file_extension unrestricted upload] |
|---|
| Points | 20 |
|---|