Executive Summary

CVE-2026-3795 is a path traversal vulnerability in doramart DoraCMS version 3.0.x, specifically in the function createFileBypath within the file /DoraCMS/server/app/router/api/v1.js. The vulnerability occurs because the application does not properly validate or sanitize the localImgPath parameter, which is taken directly from the request body and used in file upload operations.

An attacker with valid user credentials can manipulate this parameter to specify arbitrary file paths on the server. This allows the attacker to read local files and have them uploaded to external cloud storage (Qiniu or Alibaba OSS), effectively exfiltrating sensitive files remotely.

The vulnerability requires authentication but can be exploited remotely. After a successful exploit, the server deletes the local file specified, which is part of the upload process. The flaw arises from improper input sanitization and path handling, enabling unauthorized access to files outside intended directories.

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability can be detected by monitoring and testing the `/api/v1/files/path` API endpoint for path traversal attempts using the `localImgPath` parameter. Since the exploit requires authentication, attempts to access arbitrary files on the server via this endpoint with crafted `localImgPath` values can indicate exploitation.'}, {'type': 'paragraph', 'content': 'A practical detection method involves sending authenticated requests to the vulnerable endpoint with suspicious `localImgPath` values pointing to sensitive files (e.g., `/proc/self/cwd/app/public/robots.txt`) and checking if the server returns a CDN URL for the file, indicating successful file reading and exfiltration.'}, {'type': 'paragraph', 'content': 'Network detection can include monitoring for unusual outbound traffic to cloud storage services (Qiniu or Alibaba OSS) originating from the DoraCMS server, especially following authenticated API calls to `/api/v1/files/path`.'}, {'type': 'paragraph', 'content': 'Suggested commands for testing (assuming you have valid credentials and API access):'}, {'type': 'list_item', 'content': 'Use curl or similar tools to send a POST request with crafted JSON body including `localImgPath` and `filename` to `/api/v1/files/path` endpoint.'}, {'type': 'list_item', 'content': 'Example curl command (replace placeholders accordingly):\ncurl -X POST https://<doracms-server>/api/v1/files/path \\\n -H \'Authorization: Bearer <valid_token>\' \\\n -H \'Content-Type: application/json\' \\\n -d \'{"localImgPath":"/proc/self/cwd/app/public/robots.txt","filename":"robots.txt"}\''}, {'type': 'list_item', 'content': 'Check the response for a CDN URL indicating the file was read and uploaded.'}] [1]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include:

• Restrict or disable the vulnerable `/api/v1/files/path` API endpoint if possible, especially if cloud storage upload modes (`qn` or `oss`) are enabled.
• Ensure that the `localImgPath` parameter is properly validated and sanitized to prevent path traversal, restricting file access to only allowed directories.
• Limit user permissions and API tokens to minimize the risk of exploitation by unauthorized users.
• Monitor server logs and network traffic for suspicious activity related to file uploads and downloads.
• If possible, switch the upload mode from cloud storage (`qn` or `oss`) to local storage mode, as the vulnerability does not manifest in local storage mode.
• Consider replacing DoraCMS 3.0.x with an alternative product until a patch or official fix is released, as the vendor has not provided any countermeasures.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing an attacker with valid credentials to read and exfiltrate sensitive files from your server remotely. This compromises the confidentiality of your data.

Because the attacker can access arbitrary files, this may lead to exposure of sensitive configuration files, user data, or other critical information stored on the server.

The integrity and availability of your system may also be affected, as unauthorized file access could be leveraged for further attacks or disruptions.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0