CVE-2026-3795
Path Traversal in DoraCMS 3.0.x createFileBypath Function
Publication date: 2026-03-09
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| html-js | doracms | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-3795 is a path traversal vulnerability in doramart DoraCMS version 3.0.x, specifically in the function createFileBypath within the file /DoraCMS/server/app/router/api/v1.js. The vulnerability occurs because the application does not properly validate or sanitize the localImgPath parameter, which is taken directly from the request body and used in file upload operations.
An attacker with valid user credentials can manipulate this parameter to specify arbitrary file paths on the server. This allows the attacker to read local files and have them uploaded to external cloud storage (Qiniu or Alibaba OSS), effectively exfiltrating sensitive files remotely.
The vulnerability requires authentication but can be exploited remotely. After a successful exploit, the server deletes the local file specified, which is part of the upload process. The flaw arises from improper input sanitization and path handling, enabling unauthorized access to files outside intended directories.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by monitoring and testing the `/api/v1/files/path` API endpoint for path traversal attempts using the `localImgPath` parameter. Since the exploit requires authentication, attempts to access arbitrary files on the server via this endpoint with crafted `localImgPath` values can indicate exploitation.'}, {'type': 'paragraph', 'content': 'A practical detection method involves sending authenticated requests to the vulnerable endpoint with suspicious `localImgPath` values pointing to sensitive files (e.g., `/proc/self/cwd/app/public/robots.txt`) and checking if the server returns a CDN URL for the file, indicating successful file reading and exfiltration.'}, {'type': 'paragraph', 'content': 'Network detection can include monitoring for unusual outbound traffic to cloud storage services (Qiniu or Alibaba OSS) originating from the DoraCMS server, especially following authenticated API calls to `/api/v1/files/path`.'}, {'type': 'paragraph', 'content': 'Suggested commands for testing (assuming you have valid credentials and API access):'}, {'type': 'list_item', 'content': 'Use curl or similar tools to send a POST request with crafted JSON body including `localImgPath` and `filename` to `/api/v1/files/path` endpoint.'}, {'type': 'list_item', 'content': 'Example curl command (replace placeholders accordingly):\ncurl -X POST https://<doracms-server>/api/v1/files/path \\\n -H \'Authorization: Bearer <valid_token>\' \\\n -H \'Content-Type: application/json\' \\\n -d \'{"localImgPath":"/proc/self/cwd/app/public/robots.txt","filename":"robots.txt"}\''}, {'type': 'list_item', 'content': 'Check the response for a CDN URL indicating the file was read and uploaded.'}] [1]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing an attacker with valid credentials to read and exfiltrate sensitive files from your server remotely. This compromises the confidentiality of your data.
Because the attacker can access arbitrary files, this may lead to exposure of sensitive configuration files, user data, or other critical information stored on the server.
The integrity and availability of your system may also be affected, as unauthorized file access could be leveraged for further attacks or disruptions.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include:
- Restrict or disable the vulnerable `/api/v1/files/path` API endpoint if possible, especially if cloud storage upload modes (`qn` or `oss`) are enabled.
- Ensure that the `localImgPath` parameter is properly validated and sanitized to prevent path traversal, restricting file access to only allowed directories.
- Limit user permissions and API tokens to minimize the risk of exploitation by unauthorized users.
- Monitor server logs and network traffic for suspicious activity related to file uploads and downloads.
- If possible, switch the upload mode from cloud storage (`qn` or `oss`) to local storage mode, as the vulnerability does not manifest in local storage mode.
- Consider replacing DoraCMS 3.0.x with an alternative product until a patch or official fix is released, as the vendor has not provided any countermeasures.