CWE-73

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-119298",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-30T18:25:15.351502Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-30T18:35:53.606Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "croc",
          "vendor": "schollz",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 11.5.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "croc is a tool that allows any two computers to simply and securely transfer files and folders. Prior to 11.5.2, the receive-side file-readiness loop in src/croc/croc.go treats any sender-controlled basename beginning with croc-stdin- as a trusted text-transfer artifact even when SendingText is false. This skips askReceiveOverwrite and rename handling for a predictable exact-name collision in the receiver\u0027s working directory, allowing a remote sender whose transfer the user accepts to overwrite or truncate a matching regular file through recipientInitializeFile, or to remove and replace a matching destination with an empty file or an in-directory symlink through createEmptyFileAndFinish, without confirmation. The impact is limited to pre-existing names in the croc-stdin- namespace that the sender can predict; other filenames retain the prompt, dotfiles outside that namespace are not reachable, and symlink targets remain confined to the receive directory. This issue is fixed in version 11.5.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-73",
              "description": "CWE-73: External Control of File Name or Path",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T16:12:49.765Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/schollz/croc/security/advisories/GHSA-x89h-7h96-v88f",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/schollz/croc/security/advisories/GHSA-x89h-7h96-v88f"
        },
        {
          "name": "https://github.com/schollz/croc/pull/1327",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/schollz/croc/pull/1327"
        },
        {
          "name": "https://github.com/schollz/croc/commit/25fe49b6f14db99f517e902cfef76299ad0a95a3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/schollz/croc/commit/25fe49b6f14db99f517e902cfef76299ad0a95a3"
        },
        {
          "name": "https://github.com/schollz/croc/releases/tag/v11.5.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/schollz/croc/releases/tag/v11.5.2"
        }
      ],
      "source": {
        "advisory": "GHSA-x89h-7h96-v88f",
        "discovery": "UNKNOWN"
      },
      "title": "croc: Overwrite-confirmation bypass via a crafted \"croc-stdin-\" filename on receive"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-119298",
    "datePublished": "2026-10-30T16:12:49.765Z",
    "dateReserved": "2026-10-29T18:50:28.066Z",
    "dateUpdated": "2026-10-30T18:35:53.606Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-119250",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-29T20:40:06.398548Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-29T20:40:19.471Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WiFiman Desktop",
          "vendor": "Ubiquiti Inc",
          "versions": [
            {
              "lessThan": "1.3.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A malicious actor with local access and low privileges could exploit an External Control of File Name or Path vulnerability found in WiFiman Desktop to execute arbitrary commands with root privileges on the host device.\u003cbr\u003e"
            }
          ],
          "value": "A malicious actor with local access and low privileges could exploit an External Control of File Name or Path vulnerability found in WiFiman Desktop to execute arbitrary commands with root privileges on the host device."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-73",
              "description": "CWE-73 External control of file name or path",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-31T13:15:01.713Z",
        "orgId": "fe490ce8-0395-4072-90d8-2707e1bdf984",
        "shortName": "Ubiquiti"
      },
      "references": [
        {
          "url": "https://community.ui.com/releases/Security-Advisory-Bulletin-072/351a6d54-3ef7-49b4-ac99-b3a5388a9808"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "fe490ce8-0395-4072-90d8-2707e1bdf984",
    "assignerShortName": "Ubiquiti",
    "cveId": "CVE-2026-119250",
    "datePublished": "2026-10-29T18:26:35.631Z",
    "dateReserved": "2026-10-29T17:33:16.275Z",
    "dateUpdated": "2026-10-31T13:15:01.713Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-119210",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-03T16:42:59.066338Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-03T16:45:19.525Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "mariadb-connector-j",
          "vendor": "mariadb-corporation",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.3.7"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.4.0, \u003c 3.4.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.5.0, \u003c 3.5.11"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the ClientMessage.validateLocalFileName() check used a regular expression that could match LOAD DATA LOCAL INFILE text inside quoted identifiers, string literals, or comments instead of requiring a real statement. A malicious or compromised server, or a machine-in-the-middle attacker, could return crafted database or table identifiers that the connector reused in metadata or updatable-result queries, then answer with a LOCAL INFILE request for a client file. With allowLocalInfile enabled, this caused the connector to stream any readable client-host file named by the crafted text, including through DatabaseMetaData.getImportedKeys(), DatabaseMetaData.getExportedKeys(), or ResultSet.updateRow() paths. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-73",
              "description": "CWE-73: External Control of File Name or Path",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-29T20:45:38.135Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-fhx5-2xqw-2cgm",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-fhx5-2xqw-2cgm"
        },
        {
          "name": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/4d2f8002399949ed7f138e9c0b75b69229538120",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/4d2f8002399949ed7f138e9c0b75b69229538120"
        },
        {
          "name": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/5812e0ca7574c3934915179b76f2e819a556d099",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/5812e0ca7574c3934915179b76f2e819a556d099"
        },
        {
          "name": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/a4891f877f1c885a573194771c1ed0aacec0ce1d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/a4891f877f1c885a573194771c1ed0aacec0ce1d"
        },
        {
          "name": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.7"
        },
        {
          "name": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.5"
        },
        {
          "name": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.11",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.11"
        }
      ],
      "source": {
        "advisory": "GHSA-fhx5-2xqw-2cgm",
        "discovery": "UNKNOWN"
      },
      "title": "MariaDB Connector/J: LOAD DATA LOCAL INFILE file check could be satisfied by text inside quoted identifiers, letting a malicious server read client files"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-119210",
    "datePublished": "2026-10-29T20:45:38.135Z",
    "dateReserved": "2026-10-29T16:04:48.729Z",
    "dateUpdated": "2026-11-03T16:45:19.525Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-119198",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-03T16:27:32.159649Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-03T16:28:50.623Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "nuxt",
          "vendor": "nuxt",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.6.0, \u003c 4.6.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, a client with TCP access to an exposed Nuxt development server can send a nuxt:dev:client-error event over the HMR socket with an absolute file path at the end of its message. The development server reads that file while building the client error report and returns its contents through the error overlay, development error channel, and terminal report, bypassing Vite\u0027s server.fs allow list. The default localhost binding limits remote exposure, cross-origin browser requests are rejected, production builds and Nuxt 3 are not affected, and no browser interaction is required. This issue is fixed in version 4.6.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-73",
              "description": "CWE-73: External Control of File Name or Path",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-29T20:11:35.300Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/nuxt/nuxt/security/advisories/GHSA-x287-wcfc-q46c",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/nuxt/nuxt/security/advisories/GHSA-x287-wcfc-q46c"
        },
        {
          "name": "https://github.com/nuxt/nuxt/commit/35856eb148bf8d6f1ad753c5b8b337c52b4fd6b3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nuxt/nuxt/commit/35856eb148bf8d6f1ad753c5b8b337c52b4fd6b3"
        },
        {
          "name": "https://github.com/nuxt/nuxt/commit/aec8129f68e9b870ca919f8f60e65a4608c8a6d8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nuxt/nuxt/commit/aec8129f68e9b870ca919f8f60e65a4608c8a6d8"
        },
        {
          "name": "https://github.com/nuxt/nuxt/releases/tag/v4.6.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nuxt/nuxt/releases/tag/v4.6.3"
        }
      ],
      "source": {
        "advisory": "GHSA-x287-wcfc-q46c",
        "discovery": "UNKNOWN"
      },
      "title": "Nuxt dev server arbitrary file read through client error reports"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-119198",
    "datePublished": "2026-10-29T20:11:35.300Z",
    "dateReserved": "2026-10-29T16:04:48.728Z",
    "dateUpdated": "2026-11-03T16:28:50.623Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.2,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "HIGH",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-118561",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-06T13:42:34.768983Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-06T13:43:00.963Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/single_content_sync",
          "product": "Single Content Sync",
          "repo": "https://git.drupalcode.org/project/single_content_sync",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "1.4.19",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "jvdkolk"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "killianacc"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "K\u00c3\u00a9vin Le lostec (klelostec)"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "nicocha30"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "killianacc"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Oleksandr Kuzava (nginex)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Swan Kalata (akalata)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Greg Knaddison (greggles)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Juraj Nemec (poker10)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Jess  (xjm)"
        }
      ],
      "datePublic": "2026-10-28T17:17:30.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "External Control of File Name or Path vulnerability in Drupal Single Content Sync allows Path Traversal. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-126",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-126 Path Traversal"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-73",
              "description": "CWE-73 External Control of File Name or Path",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T03:08:51.799Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-274"
        }
      ],
      "title": "Single Content Sync - Critical - External control of file name or path - SA-CONTRIB-2026-274"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-118561",
    "datePublished": "2026-10-30T03:08:51.799Z",
    "dateReserved": "2026-10-28T15:50:46.719Z",
    "dateUpdated": "2026-11-06T13:43:00.963Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://packagist.org/packages/symfony/serializer",
          "defaultStatus": "unaffected",
          "modules": [
            "Symfony\\Component\\Serializer\\Normalizer\\DataUriNormalizer::denormalize()"
          ],
          "packageName": "symfony/serializer",
          "product": "symfony",
          "repo": "https://github.com/symfony/serializer",
          "vendor": "sensiolabs",
          "versions": [
            {
              "lessThan": "5.4.56",
              "status": "affected",
              "version": "0",
              "versionType": "git"
            },
            {
              "lessThan": "6.4.50",
              "status": "affected",
              "version": "6.0.0",
              "versionType": "git"
            },
            {
              "lessThan": "7.4.23",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "git"
            },
            {
              "lessThan": "8.1.11",
              "status": "affected",
              "version": "8.0.0",
              "versionType": "git"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.56",
                  "versionStartIncluding": "0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4.50",
                  "versionStartIncluding": "6.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.4.23",
                  "versionStartIncluding": "7.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "8.1.11",
                  "versionStartIncluding": "8.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Oliver Wenzel"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Nicolas Grekas"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003eThe Symfony Serializer component\u0026nbsp;\u003ccode\u003eDataUriNormalizer\u003c/code\u003e\u0026nbsp;handles only the exact types\u0026nbsp;\u003ccode\u003eSplFileInfo\u003c/code\u003e\u003cspan\u003e, \u003c/span\u003e\u003ccode\u003eSplFileObject\u003c/code\u003e\u003cspan\u003e, and \u003c/span\u003e\u003ccode\u003eFile\u003c/code\u003e\u003cspan\u003e, so for a property typed with a subclass such as \u003c/span\u003e\u003ccode\u003eUploadedFile\u003c/code\u003e\u003cspan\u003e, \u003c/span\u003e\u003ccode\u003eObjectNormalizer\u003c/code\u003e\u003cspan\u003e instantiates the object through its constructor from attacker-controlled data, including the file path. This allows an arbitrary file on the server to be treated as an uploaded file in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11.\u003c/span\u003e\u003c/div\u003e\u003cdiv\u003eA request body such as\u0026nbsp;\u003ccode\u003e{\"image\": {\"path\": \"/path/to/project/.env.local\", \"originalName\": \"a.png\", \"test\": true}}\u003c/code\u003e\u0026nbsp;makes the application handle any file on the server as an upload, without the file being sent. With\u0026nbsp;\u003ccode\u003etest: true\u003c/code\u003e,\u0026nbsp;\u003ccode\u003eUploadedFile::isValid()\u003c/code\u003e\u0026nbsp;skips\u0026nbsp;\u003ccode\u003eis_uploaded_file()\u003c/code\u003e\u0026nbsp;and\u0026nbsp;\u003ccode\u003emove()\u003c/code\u003e\u0026nbsp;falls back to\u0026nbsp;\u003ccode\u003erename()\u003c/code\u003e.\u0026nbsp;\u003ccode\u003eAssert\\File\u003c/code\u003e\u0026nbsp;does not prevent this because it validates\u0026nbsp;the file at the attacker-chosen path, which exists on the server.\u003cbr\u003e\u003cdiv\u003eAny code that deserializes untrusted data into a type that holds such a property is affected. That includes\u0026nbsp;\u003ccode\u003e#[MapRequestPayload]\u003c/code\u003e\u0026nbsp;on a DTO with an\u0026nbsp;\u003ccode\u003eUploadedFile\u003c/code\u003e\u0026nbsp;property, which is how uploads are mapped in Symfony 8.1; a single unauthenticated request with a JSON or form body is enough. Depending on what the application does with the upload, this can expose any file readable by PHP (for instance, when uploads are stored and served back), move any such file when\u0026nbsp;\u003ccode\u003emove()\u003c/code\u003e\u0026nbsp;is called, and reveal whether a path exists.\u003c/div\u003e\u003cdiv\u003eA serializer built without\u0026nbsp;\u003ccode\u003eDataUriNormalizer\u003c/code\u003e\u0026nbsp;ahead of the object normalizer is not protected by the fix; the serializer configured by\u0026nbsp;\u003ccode\u003eFrameworkBundle\u003c/code\u003e\u0026nbsp;is.\u003c/div\u003e\u003c/div\u003e"
            }
          ],
          "value": "The Symfony Serializer component\u00a0DataUriNormalizer\u00a0handles only the exact types\u00a0SplFileInfo, SplFileObject, and File, so for a property typed with a subclass such as UploadedFile, ObjectNormalizer instantiates the object through its constructor from attacker-controlled data, including the file path. This allows an arbitrary file on the server to be treated as an uploaded file in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11.\n\nA request body such as\u00a0{\"image\": {\"path\": \"/path/to/project/.env.local\", \"originalName\": \"a.png\", \"test\": true}}\u00a0makes the application handle any file on the server as an upload, without the file being sent. With\u00a0test: true,\u00a0UploadedFile::isValid()\u00a0skips\u00a0is_uploaded_file()\u00a0and\u00a0move()\u00a0falls back to\u00a0rename().\u00a0Assert\\File\u00a0does not prevent this because it validates\u00a0the file at the attacker-chosen path, which exists on the server.\nAny code that deserializes untrusted data into a type that holds such a property is affected. That includes\u00a0#[MapRequestPayload]\u00a0on a DTO with an\u00a0UploadedFile\u00a0property, which is how uploads are mapped in Symfony 8.1; a single unauthenticated request with a JSON or form body is enough. Depending on what the application does with the upload, this can expose any file readable by PHP (for instance, when uploads are stored and served back), move any such file when\u00a0move()\u00a0is called, and reveal whether a path exists.\n\nA serializer built without\u00a0DataUriNormalizer\u00a0ahead of the object normalizer is not protected by the fix; the serializer configured by\u00a0FrameworkBundle\u00a0is."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-73",
              "description": "CWE-73 External control of file name or path",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-06T16:17:01.487Z",
        "orgId": "596c5446-0ce5-4ba2-aa66-48b3b757a647",
        "shortName": "Checkmarx"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://github.com/symfony/symfony/security/advisories/GHSA-h38r-xrmh-cwhr"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/symfony/symfony/commit/72ece5bb3084e8233325166357f85c8c0650ee86"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/symfony/symfony/commit/c459104eb18ebda31e112c5490970da3f30bd668"
        }
      ],
      "source": {
        "advisory": "GHSA-h38r-xrmh-cwhr",
        "discovery": "UNKNOWN"
      },
      "title": "Symfony: The Serializer Builds UploadedFile Objects From Request Data, Letting a Client Point an Upload at Any Server File",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "596c5446-0ce5-4ba2-aa66-48b3b757a647",
    "assignerShortName": "Checkmarx",
    "cveId": "CVE-2026-118515",
    "datePublished": "2026-11-06T16:17:01.487Z",
    "dateReserved": "2026-10-28T14:33:36.992Z",
    "dateUpdated": "2026-11-06T16:17:01.487Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-116822",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-27T13:46:12.648366Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-27T14:15:27.706Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "yeswiki",
          "vendor": "YesWiki",
          "versions": [
            {
              "lessThan": "4.7.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "4.7.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:yeswiki:yeswiki:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.7.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "manus-pi"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "manus-use"
        }
      ],
      "datePublic": "2026-10-12T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "YesWiki before 4.7.0 contains a path traversal vulnerability in BazarListeAction that allows unauthenticated attackers to select arbitrary templates within the @bazar Twig namespace via the template GET parameter. Attackers can append crafted template values to pages containing the bazarliste action to force unintended layouts, causing page defacement for visitors following the crafted link."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-73",
              "description": "External Control of File Name or Path",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-26T23:05:48.458Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-qfv2-x8g4-qg27)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/YesWiki/yeswiki/security/advisories/GHSA-qfv2-x8g4-qg27"
        },
        {
          "name": "VulnCheck Advisory: YesWiki before 4.7.0 Template Traversal via BazarListeAction template Parameter",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/yeswiki-before-4.7.0-template-traversal-via-bazarlisteaction-template-parameter"
        }
      ],
      "title": "YesWiki before 4.7.0 Template Traversal via BazarListeAction template Parameter",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-116822",
    "datePublished": "2026-10-26T23:05:48.458Z",
    "dateReserved": "2026-10-26T22:14:57.233Z",
    "dateUpdated": "2026-10-27T14:15:27.706Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-116249",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-06T16:19:30.753762Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-06T16:19:45.264Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Servers",
            "Import/Export Servers"
          ],
          "product": "pgAdmin 4",
          "programFiles": [
            "https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/utils/__init__.py",
            "https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/utils/driver/psycopg3/server_manager.py"
          ],
          "repo": "https://github.com/pgadmin-org/pgadmin4",
          "vendor": "pgadmin.org",
          "versions": [
            {
              "lessThan": "9.19",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Dave Page \u003cdpage@pgadmin.org\u003e"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "Kundan Sable \u003ckundan.sable@enterprisedb.com\u003e"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "Hitesh Jambhale \u003chitesh.jambhale@enterprisedb.com\u003e"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "Ashesh Vashi \u003cashesh.vashi@enterprisedb.com\u003e"
        }
      ],
      "datePublic": "2026-10-29T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "In server mode pgAdmin 4 resolves a server\u0027s password file, SSL certificate, key, CRL and SSH tunnel identity file relative to the user\u0027s storage directory, but get_complete_file_path() only stripped leading slashes before joining the two. A path such as \"../\u003canother user\u003e/.pgpass\", set through the server dialog, the REST API or a servers.json import, therefore named another user\u0027s file, and connecting used that user\u0027s saved passwords, client certificate or SSH key. The sslkeylogfile connection parameter was passed to libpq unchanged, so a path outside storage let libpq create or append a file as the account running pgAdmin.\n\nmake_conninfo() also quoted connection parameter values but not their names, so a crafted parameter name could smuggle additional keyword=value pairs past these checks.\n\nThe fix requires the resolved path, with symbolic links followed, to stay inside the user\u0027s storage directory or the named shared storage directory, confines sslkeylogfile the same way, and accepts only exact libpq keywords as connection parameter names. A refused path or keyword is reported instead of letting libpq fall back to a default.\n\nThis issue affects pgAdmin 4: before 9.19."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "Any authenticated user who can register a server. Attack Complexity is High: the victim must keep such a file in their storage directory, and the attacker must know its name and a host and role it is accepted for. Scope is Changed because the connection is made to a database server with another user\u0027s credentials, an authority the attacker was never given; Confidentiality and Integrity are High for that access. Availability is Low for the file sslkeylogfile can create or append to outside storage."
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:L/VA:L/SC:H/SI:H/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "Same reasoning as the CVSS 3.1 entry. AT:P for the victim\u0027s file and its name, which the attacker does not control. VC:H for the credential read through pgAdmin, VI:L/VA:L for the sslkeylogfile write; SC:H/SI:H for the database server reached with the other user\u0027s identity."
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-73",
              "description": "CWE-73 External Control of File Name or Path",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T19:55:18.121Z",
        "orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
        "shortName": "PostgreSQL"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/pgadmin-org/pgadmin4/issues/10650"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/pgadmin-org/pgadmin4/commit/2afe505ef4a31591796449d54ab1604355ff06c2"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "pgAdmin 4: Connection file paths and parameter keys escape the user\u0027s storage directory"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
    "assignerShortName": "PostgreSQL",
    "cveId": "CVE-2026-116249",
    "datePublished": "2026-10-30T19:55:18.121Z",
    "dateReserved": "2026-10-25T16:26:16.420Z",
    "dateUpdated": "2026-11-06T16:19:45.264Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-115931",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-02T15:04:40.311372Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-02T15:07:14.710Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "postiz-app",
          "product": "postiz-app",
          "repo": "https://github.com/gitroomhq/postiz-app",
          "vendor": "GitroomHQ",
          "versions": [
            {
              "lessThan": "2.25.2",
              "status": "affected",
              "version": "2.23.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "The default configuration is affected and no setting has to be changed. Self-registration is open unless DISABLE_REGISTRATION is set to true; with registration closed, any existing user can still exploit the issue."
        },
        {
          "lang": "en",
          "value": "The image built from the project\u0027s Dockerfile.dev runs the process as root, so every file root can read is exposed. The process\u0027s own environment is readable regardless of the user it runs as."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Anthropic, PBC"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Enno Gelhaus"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Nevo David"
        }
      ],
      "datePublic": "2026-10-23T22:00:00.481Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Postiz lets a signed-in user ask the backend to run a function on one of their connected channels. The backend did not restrict which functions can be requested, so a user could call internal helper functions that were never meant to be reachable from the web interface.\n\nOne of those helpers reads a file from the server\u0027s disk. A user who connects a channel whose stored token is a file path can have the backend return the contents of any file it can read, including its environment, which holds the secret used to sign login sessions, the database address and the credentials of connected services. Another helper makes the backend process exit with a single request. Self-registration is open by default, so no existing account and no action by another user is needed."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "Exploitation was demonstrated end to end against an unmodified build of Postiz at commit 3a7d28b7ad96, using only a self-registered account: the contents of a file placed outside the application\u0027s directories and the exact JWT secret the backend was started with were both returned in full. Terminating the backend with one request was demonstrated separately."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Any registered user can read any file the backend process can read, with the result returned as bytes so binary files work."
            }
          ]
        },
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "The backend\u0027s environment is readable, which exposes the JWT signing secret, the database and Redis connection strings and the credentials and API keys of connected providers when they are passed as environment variables."
            }
          ]
        },
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "With the JWT signing secret an attacker can sign a session for any user, including a user in another organization or an instance super administrator, and can decrypt data the application stores encrypted with the same secret."
            }
          ]
        },
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "A single request ends the backend process, and it can be repeated after every restart."
            }
          ]
        },
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Other provider functions become callable by any member of an organization that owns a channel, some of which return access tokens for the connected account that other routes keep server side."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-470",
              "description": "CWE-470",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-73",
              "description": "CWE-73",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-24T14:28:58.123Z",
        "orgId": "4cdc9741-f887-419a-a2fd-acbbd2729276",
        "shortName": "postiz"
      },
      "references": [
        {
          "name": "Postiz",
          "tags": [
            "product"
          ],
          "url": "https://github.com/gitroomhq/postiz-app"
        },
        {
          "name": "v2.25.2",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/gitroomhq/postiz-app/releases/tag/v2.25.2"
        },
        {
          "name": "9383f5b",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/gitroomhq/postiz-app/commit/9383f5be4d310c346e33a3748a9a7ded64c96fed"
        },
        {
          "name": "GAdvisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://gadvisory.org/advisories/PSA-2026-JNXM56"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-23T19:45:00.000Z",
          "value": "Anthropic has disclosed a thorough report of this vulnerability including a working PoC to Postiz"
        },
        {
          "lang": "en",
          "time": "2026-10-23T20:00:00.000Z",
          "value": "Postiz has reproduced the vulnerability and is working on a fix"
        },
        {
          "lang": "en",
          "time": "2026-10-23T21:33:00.000Z",
          "value": "Postiz has pushed a fix for this vulnerability and verified it"
        },
        {
          "lang": "en",
          "time": "2026-10-23T22:00:00.000Z",
          "value": "Postiz has created a release and published the advisory"
        }
      ],
      "title": "Arbitrary file read and backend crash through unrestricted provider method calls",
      "workarounds": [
        {
          "lang": "en",
          "value": "Set DISABLE_REGISTRATION=true. The attacker needs an ordinary account, so closing self-registration limits exposure to people who already hold one. This reduces reach, it does not close the issue."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4cdc9741-f887-419a-a2fd-acbbd2729276",
    "assignerShortName": "postiz",
    "cveId": "CVE-2026-115931",
    "datePublished": "2026-10-23T22:02:21.717Z",
    "dateReserved": "2026-10-23T21:19:33.246Z",
    "dateUpdated": "2026-11-02T15:07:14.710Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-114491",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-28T17:26:52.824167Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-28T17:31:25.430Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.npmjs.com",
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/pdfmake",
          "product": "pdfmake",
          "repo": "https://github.com/bpampuch/pdfmake",
          "vendor": "bpampuch",
          "versions": [
            {
              "lessThan": "0.3.12",
              "status": "affected",
              "version": "0.3.8",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:pdfmake:pdfmake:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0.3.12",
                  "versionStartIncluding": "0.3.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Zachariah Mithani (AploSec)"
        }
      ],
      "datePublic": "2026-10-17T11:46:58.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "pdfmake 0.3.8 before 0.3.12 fails to apply the setLocalAccessPolicy() restriction to images referenced inside SVG content, allowing attackers to read blocked local files. Attackers supplying a document definition can add an SVG image href pointing to a local path, embedding restricted file contents in the generated PDF."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-73",
              "description": "External Control of File Name or Path",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T17:54:16.217Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/bpampuch/pdfmake/commit/4ad4cbf2713568304dd4cbc3090bfb912a78dfdd"
        },
        {
          "name": "pdfmake 0.3.12 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/bpampuch/pdfmake/releases/tag/0.3.12"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/bpampuch/pdfmake/blob/0.3.11/src/Renderer.js#L350-L372"
        },
        {
          "name": "VulnCheck Advisory: pdfmake 0.3.8 before 0.3.12 Local File Policy Bypass via SVG Images",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/pdfmake-0.3.8-before-0.3.12-local-file-policy-bypass-via-svg-images"
        }
      ],
      "title": "pdfmake 0.3.8 before 0.3.12 Local File Policy Bypass via SVG Images",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-114491",
    "datePublished": "2026-10-21T17:54:16.217Z",
    "dateReserved": "2026-10-21T16:00:25.961Z",
    "dateUpdated": "2026-10-28T17:31:25.430Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}