nocobase @nocobase/server vulnerabilities

Latest nocobase @nocobase/server CVEs

Newest publication first

1. GHSA-ghvf-qf6h-g8x5 NocoBase: Arbitrary File Write chained with Local file Inclusion leads to Remote code execution

   Published 2026-08-20

   Unknown

   Executive Summary Two vulnerabilities were identified and chained to achieve authenticated remote code execution The first vulnerability allows any authenticated admin to redirect the file upload storage root to an arbitrary path on disk including the application directory itself...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.