Two vulnerabilities in Nocobase ≤2.0.57 were identified and chained to achieve authenticated remote code execution. The first vulnerability allows an authenticated admin to redirect the file upload storage root to any absolute filesystem path by supplying an unsanitized documentRoot value to the storages:update API, enabling arbitrary file writes including to the application directory. The second vulnerability allows the same admin to trigger Node.js require() on any absolute filesystem path via the pm:enable plugin manager endpoint without validation, enabling local file inclusion. Chained together, these allow an attacker with admin credentials to upload a malicious JavaScript payload and execute it on the server. A working proof-of-concept exploit requires only a valid admin session token. The vulnerabilities are fixed in version 2.1.5.

An attacker with valid admin credentials can write arbitrary files to any location writable by the Node.js process, including the application root, and then execute arbitrary code by triggering a local file inclusion via the pm:enable endpoint. This results in authenticated remote code execution on the server hosting Nocobase ≤2.0.57. The vulnerabilities expose the system to full compromise by authorized users.

An official fix is available in Nocobase version 2.1.5. Users should upgrade to version 2.1.5 or later to remediate these vulnerabilities. Until upgraded, restrict admin access tightly and monitor for suspicious activity. No other vendor-recommended mitigations are provided.