CVE-2023-1800: Unrestricted Upload of File with Dangerous Type

April 2, 2023 (updated April 7, 2023)

A vulnerability, which was classified as critical, has been found in sjqzhang go-fastdfs up to 1.4.3. Affected by this issue is the function upload of the file /group1/uploa of the component File Upload Handler. The manipulation leads to path traversal: ‘../filedir’. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-224768.

References

github.com/advisories/GHSA-xq3x-grrj-fj6x
github.com/yangyanglo/ForCVE/blob/main/2023-0x05.md
nvd.nist.gov/vuln/detail/CVE-2023-1800
vuldb.com/?ctiid.224768
vuldb.com/?id.224768

Code Behaviors & Features

Detect and mitigate CVE-2023-1800 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →