ChestnutCMS vulnerabilities

ChestnutCMS version 1.5.10 has a SQL injection vulnerability. The content parameter of the cms_content tag can be manipulated in the admin backend and injected into a SQL query when the template is rendered.

A flaw has been found in liweiyi ChestnutCMS up to 1.5.8. This vulnerability affects the function FilenameUtils.getExtension of the file /dev-api/common/upload. Manipulation of the argument File can lead to unrestricted upload, and the attack may be launched remotely.

In liweiyi ChestnutCMS up to 1.5.8, the resourceDownload function in /dev-api/common/download is vulnerable to path traversal via manipulation of the path argument. The attack can be launched remotely, and the exploit is publicly available.