Casbin vulnerabilities
9 vulnerabilities
Known vulnerabilities in Casbin products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 1 product.
Products
1- Casdoor9 vulnerabilities
CVE-2022-38638casbincasdoor+2
EPSS score1.23%
Casdoor v1.97.3 was discovered to contain an arbitrary file write vulnerability via the fullFilePath parameter at /api/upload-resource.CVE-2022-44942casbincasdoor+1EPSS score0.90%
Casdoor before v1.126.1 was discovered to contain an arbitrary file deletion vulnerability via the uploadFile function.CVE-2022-24124casbincasdoor+2EPSS score55.30%
The query API in Casdoor before 1.13.1 has a SQL injection vulnerability related to the field and value parameters, as demonstrated by api/get-organizations.CVE-2024-41264casbincasdoor+1EPSS score0.46%
An issue discovered in casdoor v1.636.0 allows attackers to obtain sensitive information via the ssh.InsecureIgnoreHostKey() method.CVE-2026-5469casbincasdoor+1EPSS score0.57%
A weakness has been identified in Casdoor 2.356.0. This vulnerability affects unknown code of the component Webhook URL Handler. Executing a manipulation can lead to server-side request forgery. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.CVE-2026-5467casbincasdoor+1EPSS score0.43%
A vulnerability was identified in Casdoor 2.356.0. Affected by this issue is some unknown functionality of the component OAuth Authorization Request Handler. Such manipulation of the argument redirect_uri leads to open redirect. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.CVE-2026-5468casbincasdoor+1EPSS score0.32%
A security flaw has been discovered in Casdoor 2.356.0. This affects the function dangerouslySetInnerHTML. Performing a manipulation of the argument formCss/formCssMobile/formSideHtml results in cross site scripting. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.CVE-2026-6815casbincasdoor+2EPSS score0.59%
An arbitrary file write vulnerability exists in Casdoor's Local File System storage provider. Due to insufficient path sanitization, an authenticated attacker with administrative privileges can perform a Path Traversal attack to create or overwrite arbitrary files anywhere on the host filesystem, bypassing the application's intended storage sandbox.CVE-2023-34927casbincasdoor+1EPSS score3.07%
Casdoor v1.331.0 and below was discovered to contain a Cross-Site Request Forgery (CSRF) in the endpoint /api/set-password. This vulnerability allows attackers to arbitrarily change the victim user's password via supplying a crafted URL.