CVE-2026-3795
MEDIUMdoramart DoraCMS 3.0.x - Path Traversal via createFileBypath Function
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2026-3795. PoCs published by LTX-GOD.
AI-analyzed exploit summary This repository contains a functional exploit PoC for CVE-2026-3795, which involves an arbitrary file read and exfiltration vulnerability in DoraCMS 3.0.0. The exploit leverages the `/api/v1/files/path` endpoint to read local files and upload them to cloud storage (Qiniu/OSS), allowing remote attackers to exfiltrate sensitive data.
Description
A security flaw has been discovered in doramart DoraCMS 3.0.x. Impacted is the function createFileBypath of the file /DoraCMS/server/app/router/api/v1.js. Performing a manipulation results in path traversal. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Exploits (1)
This repository contains a functional exploit PoC for CVE-2026-3795, which involves an arbitrary file read and exfiltration vulnerability in DoraCMS 3.0.0. The exploit leverages the `/api/v1/files/path` endpoint to read local files and upload them to cloud storage (Qiniu/OSS), allowing remote attackers to exfiltrate sensitive data.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L