A path traversal vulnerability in Casdoor, the open-source identity and access management platform, has been disclosed. Tracked as CVE-2026-6815, the bug affects versions before 3.54.1 and lets an authenticated administrator write arbitrary files to the host filesystem.
The issue sits in the storage provider management component. By creating a ‘Local File System’ provider with a manipulated ‘pathPrefix’ value, an attacker can break out of the storage sandbox and target any file on the underlying system.
The practical impact is severe. An attacker could inject SSH keys to gain remote code execution, upload a web shell to another application’s directory, or corrupt the application database to cause persistent denial of service. Success depends on the OS-level permissions of the user running the Casdoor service.
The exploit requires administrator credentials, which limits the attack surface. Still, any internet-facing Casdoor instance with a compromised admin account is at risk. The vendor has patched this in version 3.54.1 — if you’re running Casdoor, update now.
