| Title | wwwlike vlife 1.0.3 Unrestricted Upload |
|---|
| Description | Vulnerability Overview
There is an unrestricted file upload flow in SysFileService#uploadImg. The service derives the stored file extension from the client-controlled multipart filename and writes the complete, unvalidated upload body to disk, , leading to Unrestricted Upload of File with Dangerous Type.
Affected Component
Project: wwwlike/vlife
Affected Files:
DataSet/CVE_Project/wwwlike_vlife_CVE-2025-13266_2.0.1/vlife-base/src/main/java/cn/wwwlike/sys/api/SysFileApi.java
DataSet/CVE_Project/wwwlike_vlife_CVE-2025-13266_2.0.1/vlife-base/src/main/java/cn/wwwlike/sys/service/SysFileService.java
Affected Endpoint:
POST /sysFile/upload
Vulnerability Details
Root Cause
The vulnerable upload implementation exists in SysFileService#uploadImg, which extracts an extension from the attacker-controlled original filename. It then writes all uploaded bytes to disk without validating that the content is an image:
public String uploadImg(MultipartFile multipartFile) {
...
String fileName = getFileName() + "." + multipartFile.getOriginalFilename().split("\\.")[1];
String pathFileName = imgPath + "/" + fileName;
FileUtil.createDir(imgPath);
...
File file = new File(pathFileName);
OutputStream out = null;
try {
out = new FileOutputStream(file);
byte[] ss = multipartFile.getBytes();
for (int i = 0; i < ss.length; i++) {
out.write(ss[i]);
}
The root causes are:
Untrusted extension extraction: The service trusts an extension derived from getOriginalFilename() and does not restrict uploads to expected image formats.
No content verification: The code does not verify MIME type, magic bytes, image decoding, or any other property of the uploaded bytes.
Attack Vector
An authenticated remote attacker can exploit the vulnerability by:
Supplying arbitrary bytes in the multipart field named file.
Giving the upload a simple filename with an arbitrary extension, such as payload.pdf.
Affected Versions
vlife ≤ 2.0.1 |
|---|
| Source | ⚠️ https://github.com/wwwlike/vlife/issues/6 |
|---|
| User | CyanM0un (UID 99906) |
|---|
| Submission | 07/17/2026 07:15 (2 months ago) |
|---|
| Moderation | 08/30/2026 11:58 (1 month later) |
|---|
| Status | Duplicate |
|---|
| VulDB entry | 332601 [wwwlike vlife up to 2.0.1 VLifeApi SysFileApi.java create fileName path traversal] |
|---|
| Points | 0 |
|---|