CVE-2018-18315: Mossle Lemon

High severity, CVSS 7.5. EPSS: 1.2% chance of exploitation in the next 30 days.

com/mossle/cdn/CdnController.java in lemon 1.9.0 allows attackers to upload arbitrary files because the copyMultipartFileToFile method in CdnUtils only checks for a ../ substring, and does not validate the file type and spaceName parameter.

Affected products

• Mossle Lemon: version 1.9.0 only

Published 2018-10-15. Last modified 2026-06-17.