PT-2026-106018
CVE-2026-102779
·
تاريخ النشر
2026-10-05
·
تاريخ التحديث
2026-10-05
الوصف من
CVSS 3.1
7.3
عاليةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Name of the Vulnerable Software and Affected Versions
TF Content versions 2.9.0 through 2.9.4
Description
The extension exposes the site task
records.custom action without authentication, Access Control List (ACL), Cross-Site Request Forgery (CSRF) protection, task-trigger, content-binding, or cron-token enforcement. This allows an unauthenticated guest to provide the numeric ID of any published TF Content task and force the component to execute its configured executor immediately.Recommendations
Update TF Content to a version later than 2.9.4.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾