Read the docs
TI-2022-22096 Aliases CVE-2022-44942GHSA-f93f-55c2-8c89

Casdoor before v1.126.1 was discovered to contain an arbitrary file deletion vulnerability via the uploadFile function.

Priority HIGH 68CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub.

Summary

Casdoor before v1.126.1 was discovered to contain an arbitrary file deletion vulnerability via the uploadFile function.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00901 59th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed github.com/casdoor/casdoor (Go): 1.126.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—github.com/casdoor/casdoor (Go)before 1.126.11.126.1Patch availableGHSA-f93f-55c2-8c89
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • github.com/casdoor/casdoor (Go) Vendor— Affected before 1.126.1 Fixed in 1.126.1 Patch available GHSA-f93f-55c2-8c89

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:casbin:casdoor:*:*:*:*:*:*:*:*before 1.126.1VulnerableCasdoor
  • cpe:2.3:a:casbin:casdoor:*:*:*:*:*:*:*:* Versions before 1.126.1 Vulnerable ·Casdoor

Remediation

  • Fix · GHSA-f93f-55c2-8c89 github.com/casdoor/casdoor (Go) Fixed in 1.126.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-44942
  2. 2026-10-03 Alias added: GHSA-f93f-55c2-8c89

References

Exploit 1

Advisory 1

Other 3

  • TI-2024-27720 GHSL-2024-035: Casdoor CORS misconfiguration CVSS 3.1HIGH 8.8
  • TI-2022-08069 The query API in Casdoor before 1.13.1 has a SQL injection vulnerability related to the… CVSS 3.1HIGH 7.5
  • TI-2023-17434 Casdoor v1.331.0 and below was discovered to contain a Cross-Site Request Forgery (CSRF)… CVSS 3.1MEDIUM 6.5
  • TI-2024-27721 GHSL-2024-036: Reflected XSS in QrCodePage.js CVSS 3.1MEDIUM 6.1
  • TI-2026-04788 Casdoor OAuth Authorization Request redirect CVSS 4.0MEDIUM 5.3
  • TI-2022-18179 Casdoor v1.97.3 was discovered to contain an arbitrary file write vulnerability via the… CVSS 3.1CRITICAL 9.1
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences