CVE-2022-38638

9.1 criticalEPSS 1.2%

Critical (9.1) in casbin casdoor. EPSS 1.2% chance of exploitation in the next 30 days. Fixed in github.com/casdoor/casdoor 1.103.1.

Casdoor v1.97.3 was discovered to contain an arbitrary file write vulnerability via the fullFilePath parameter at /api/upload-resource.

Severity

9.1 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

EPSS: 1.2% chance of exploitation in the next 30 days; higher than 68% of CVEs (scores of 2026-10-31)
CWE: CWE-22
Published: 2022-09-09
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-9vm3-r8gq-cr6x	Go	github.com/casdoor/casdoor	<1.103.1	1.103.1
GO-2022-1006	Go	github.com/casdoor/casdoor	<1.103.1	1.103.1
PYSEC-2022-43190	PyPI	casdoor	<=1.97.3	no fix published