Description
A vulnerability classified as critical has been found in openviglet shio up to 0.3.8. Affected is the function shStaticFileUpload of the file shio-app/src/main/java/com/viglet/shio/api/staticfile/ShStaticFileAPI.java. The manipulation of the argument filename leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Metrics
CVSS 3.1 9.8/10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| openviglet | shio | 0.3.0; 0.3.1; 0.3.2; 0.3.3; 0.3.4; 0.3.5; 0.3.6; 0.3.7; 0.3.8 |
References
- https://github.com/openviglet/shio/issues/1029Exploit, Issue Tracking, Vendor Advisory
- https://github.com/openviglet/shio/issues/1029#issue-3239422554Exploit, Issue Tracking, Vendor Advisory
- https://vuldb.com/?ctiid.318294Permissions Required, VDB Entry
- https://vuldb.com/?id.318294Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.617680Third Party Advisory, VDB Entry
- https://github.com/openviglet/shio/issues/1029Exploit, Issue Tracking, Vendor Advisory
Timeline
- Published
- Jul 31, 2025
- Last modified
- Jun 17, 2026
- NVD status
- Analyzed