CVE-2018-18315

Name of the Vulnerable Software and Affected Versions lemon version 1.9.0

Description The issue allows attackers to upload arbitrary files due to insufficient validation in the copyMultipartFileToFile method within CdnUtils. Specifically, it only checks for a ../ substring and does not validate the file type and spaceName parameter.

Recommendations For lemon version 1.9.0, consider validating the file type and spaceName parameter in the copyMultipartFileToFile method to prevent arbitrary file uploads. As a temporary workaround, restrict access to the CdnController to minimize the risk of exploitation.