Threats affecting pkg:github/wwwlike/vlife

vlife versions up to and including 2.0.1 have an authentication bypass vulnerability due to a hardcoded cryptographic key used for JWT signing. This allows unauthenticated attackers to forge JWT tokens with superUser privileges, granting super administrator access to any URL on affected vlife instances.

A security vulnerability has been detected in wwwlike vlife up to 2.0.1. This issue affects the function create of the file vlife-base/src/main/java/cn/wwwlike/sys/api/SysFileApi.java of the component VLifeApi. Such manipulation of the argument fileName leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.