{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"1.97.3"}],"component":"casdoor","cve_ids":["CVE-2022-38638"],"ecosystem":"PyPI","epss":0.01226,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-9vm3-r8gq-cr6x","id":"tcs_01M5KGHY2PYPGJWBGAH9WM1YXF","modified_at":"2026-10-04T17:00:02.247223556Z","published_at":"2022-09-09T20:15:11.340Z","references":["https://osv.dev/vulnerability/PYSEC-2022-43190","https://github.com/casdoor/casdoor/issues/1035"],"severity":{"label":"critical","score":9.1},"sources":[{"source":"osv","source_id":"PYSEC-2022-43190","url":"https://osv.dev/vulnerability/PYSEC-2022-43190"}],"summary":"Casdoor v1.97.3 was discovered to contain an arbitrary file write vulnerability via the fullFilePath parameter at /api/upload-resource."}