Adam Nurudini

**Name of the Vulnerable Software and Affected Versions** ClipBucket V5 (affected versions not specified) **Description** The web installer fails to properly validate or escape the `php cli filepath` parameter before passing it to shell execution. This allows unauthenticated attackers to submit a crafted POST request to the installer with a malicious value in the `php cli filepath` variable to execute arbitrary commands as the web server user. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** rConfig versions prior to 8.2.13 **Description** Authenticated users can read arbitrary files by providing crafted filenames containing directory traversal sequences to the export download endpoint. By manipulating the `filename` parameter, an attacker can escape the intended export directory and access files outside of it that are readable by the application process. Path traversal is a technique used to access files and directories that are stored outside the web root folder. **Recommendations** Update to version 8.2.13 or later. Avoid using the `filename` parameter in the export download endpoint until the update is applied.

**Name of the Vulnerable Software and Affected Versions** rConfig versions 8.0.0 through 8.2.12 **Description** An authentication bypass exists due to a duplicate `Auth::routes()` call in the `routes/web.php` file, which inadvertently re-enables the `POST /register` endpoint after it had been disabled. This allows unauthenticated attackers to self-register accounts. Because the registration controller does not assign a specific role and the `users.role` column defaults to Admin, newly created accounts are granted full Administrator privileges. This can lead to unauthorized access to stored device credentials, user data, and the issuance of API tokens. **Recommendations** Update rConfig to version 8.2.13 or later. As a temporary mitigation, restrict access to the `POST /register` endpoint.