CVE-2026-108682 Details

A denial-of-service vulnerability has been identified in zhayujie CowAgent versions through 2.1.6. The issue arises in the Web Console component, specifically within the upload function, which handles file and directory uploads. The vulnerability allows an attacker to upload large files or directories containing many files, leading to excessive memory consumption, disk space exhaustion, and service disruption. The problem stems from the absence of file size limits, file count restrictions for directory uploads, and a total upload size cap. This vulnerability can be exploited remotely, and a public exploit is available.

To address this vulnerability, it is recommended to implement upload limits before parsing multipart form data. This includes checking the 'CONTENT_LENGTH' header and rejecting oversized bodies with an HTTP 413 status. The upload handling should be revised to use a limited read function or a streaming copy helper that enforces size restrictions. Directory uploads should also be capped at a maximum number of files and total size, with additional checks for path and filename lengths. After applying these limits, regression tests should be added to ensure the upload handler correctly enforces the new restrictions.