提交 #893776: wwwlike vlife 1.0.3 Unrestricted Upload

Vulnerability Overview
There is an unrestricted file upload flow in SysFileService#uploadImg. The service derives the stored file extension from the client-controlled multipart filename and writes the complete, unvalidated upload body to disk, , leading to Unrestricted Upload of File with Dangerous Type.

Affected Component
Project: wwwlike/vlife
Affected Files:
DataSet/CVE_Project/wwwlike_vlife_CVE-2025-13266_2.0.1/vlife-base/src/main/java/cn/wwwlike/sys/api/SysFileApi.java
DataSet/CVE_Project/wwwlike_vlife_CVE-2025-13266_2.0.1/vlife-base/src/main/java/cn/wwwlike/sys/service/SysFileService.java
Affected Endpoint:
POST /sysFile/upload
Vulnerability Details
Root Cause
The vulnerable upload implementation exists in SysFileService#uploadImg, which extracts an extension from the attacker-controlled original filename. It then writes all uploaded bytes to disk without validating that the content is an image:

public String uploadImg(MultipartFile multipartFile) {
...
String fileName = getFileName() + "." + multipartFile.getOriginalFilename().split("\\.")[1];
String pathFileName = imgPath + "/" + fileName;
FileUtil.createDir(imgPath);
...
File file = new File(pathFileName);
OutputStream out = null;
try {
out = new FileOutputStream(file);
byte[] ss = multipartFile.getBytes();
for (int i = 0; i < ss.length; i++) {
out.write(ss[i]);
}
The root causes are:

Untrusted extension extraction: The service trusts an extension derived from getOriginalFilename() and does not restrict uploads to expected image formats.
No content verification: The code does not verify MIME type, magic bytes, image decoding, or any other property of the uploaded bytes.

Attack Vector
An authenticated remote attacker can exploit the vulnerability by:
Supplying arbitrary bytes in the multipart field named file.
Giving the upload a simple filename with an arbitrary extension, such as payload.pdf.

Affected Versions
vlife ≤ 2.0.1

• 来源: ⚠️ https://github.com/wwwlike/vlife/issues/6
• 用户: CyanM0un (UID 99906)
• 提交: 2026-07-17 07時15分 (3 月前)
• 管理: 2026-08-30 11時58分 (1 month later)
• 状态: 重复
• VulDB条目: 332601 [wwwlike vlife 直到 2.0.1 VLifeApi SysFileApi.java create fileName 目录遍历]
• 积分: 0