Critical Casdoor Vulnerability CVE-2026-44213 Allows Arbitrary File Overwrites

A critical arbitrary file-write vulnerability (CVE-2026-44213) in Casdoor's Local File System storage provider permits authenticated users with upload privileges to perform path traversal via unsanitized pathPrefix/fullFilePath parameters to /api/upload-resource, enabling creation or overwrite of arbitrary files on the host (possible persistence, cron jobs, database corruption, and escalation to full host compromise). Administrators are advised to restrict service account permissions, limit administrative access, and avoid or disable local storage until proper path validation is implemented.