Nocobase ≤v2.0.57 File Upload chained with LFI leads to RCE
Source Reddit BlueTeam
Fixed in 2.1.5 : update affected systems when convenient.
Data as of 17 Jun 2026, 17:20 UTC
Rated by Threat Radar
- Patch
- Available – fixed in 2.1.5
What to do
AI-suggested
An official fix is available in Nocobase version 2.1.5. Users should upgrade to version 2.1.5 or later to remediate these vulnerabilities. Until upgraded, restrict admin access tightly and monitor for suspicious activity. No other vendor-recommended mitigations are provided.
Discussion
Nocobase versions up to 2.0.57 contain two chained vulnerabilities that allow an authenticated admin to achieve remote code execution (RCE). The first vulnerability permits arbitrary file write by manipulating the file upload storage root path without validation. The second vulnerability allows local file inclusion (LFI) via an unsanitized require() call on user-supplied paths. Together, these flaws enable an attacker with admin credentials to upload and execute malicious code on the server. The issue is fixed in version 2.1.5.
r/Information_Security (opens in a new tab)u/sysinternalssuite0 points0 comments
Two vulnerabilities were identified and chained to achieve authenticated remote code execution in Nocobase ≤v2.0.57 (CVE ID Pending)
Fixed in version 2.1.5
The first vulnerability allows any authenticated admin to redirect the file upload storage root to an arbitrary path on disk including the application directory itself by supplying an unsanitized documentRoot value to the storages:update API. The second vulnerability allows the same admin to trigger Node.js require() on any absolute filesystem path via the pm:enable plugin manager endpoint, which accepts user-supplied paths with no validation (Local File Inclusion).
Chained together, these two flaws allow an attacker with admin credentials to write a malicious file and have it trigger on the system achieving remote code execution.
A working proof-of-concept exploit chain was developed and verified, requiring only a valid admin session token or admin credentials.
Link to the offical advisory: https://github.com/nocobase/nocobase/security/advisories/GHSA-ghvf-qf6h-g8x5
Link to my Github with the disclosure report:
References
- github.com/nocobase/nocobase/security/advisories/GHSA-ghvf-qf6h-g8x5 (opens in a new tab)
- reddit.com/r/Information_Security/comments/1u7m0cm/nocobase_v2057_file_upload_chained_with_lfi_leads/ (opens in a new tab)
- github.com/lukehebe/Vulnerability-Disclosures/blob/main/Nocobase%20%3C%3Dv2.0.57%20File%20Upload%20%2B%20LFI%20%3D%20RCE%20Chain.md (opens in a new tab)