Alanturing881

**Name of the Vulnerable Software and Affected Versions** fast-uri versions prior to 4.1.2 fast-uri versions prior to 3.1.5 fast-uri versions prior to 2.4.4 **Description** The software requires a literal double forward slash to recognize a URI authority. If a backslash-based introducer is used instead (such as backslash backslash, forward slash backslash, or backslash forward slash), the input is parsed without an authority and folded into the path. This creates a discrepancy with Node's native WHATWG URL parser, which treats backslashes as interchangeable with forward slashes for special schemes. Applications using the software to enforce host-based policies, such as allowlists, SSRF filtering, or redirect validation, before passing the URL to Node's URL or fetch consumers, may be steered to an unintended host. **Recommendations** Update to version 4.1.2. Update to version 3.1.5. Update to version 2.4.4.

**Name of the Vulnerable Software and Affected Versions** @fastify/forwarded versions prior to 3.0.2 **Description** When the `X-Forwarded-For` header contains two or more comma-separated entries, the parser fails to strip horizontal tabs, trimming only space characters. This contradicts RFC 7230, which defines optional whitespace as both spaces and tabs. Consequently, an entry padded with a tab retains the literal tab character in the resolved address string. This can lead to the evasion of security mechanisms that rely on exact string matching of the resolved client IP, such as allowlists, blocklists, per IP rate limit keys, or audit log correlation, as the corrupted string will not match the expected value. **Recommendations** Update to version 3.0.2.

**Name of the Vulnerable Software and Affected Versions** Wagtail versions prior to 7.0.8 Wagtail versions prior to 7.3.3 Wagtail versions prior to 7.4.2 **Description** A low-level user granted the "Can submit translation" permission can create translations for any page, regardless of whether they have the necessary permissions for those specific pages. **Recommendations** Update to version 7.0.8 Update to version 7.3.3 Update to version 7.4.2

**Name of the Vulnerable Software and Affected Versions** File Browser (affected versions not specified) **Description** File Browser fails to properly validate symbolic links, allowing scoped users or unauthenticated public-share recipients to access files outside their intended directory boundaries. While the software prevents lexical `../` traversal, it does not stop handlers from following symlinks that point to locations outside the user's scope. This occurs in two ways: when a symlink is the final path component, or when a file is accessed through a symlinked ancestor directory. This issue affects reading, writing (including TUS resumable uploads), share creation, and public-share serving. An attacker can use these flaws to read out-of-scope file contents, overwrite files, or create public shares for restricted data. Technical details include vulnerabilities in the following endpoints and functions: - API Endpoints: `GET /api/raw/{path}`, `GET /api/resources/{path}`, `POST /api/resources/{path}`, `POST /api/tus/{path}`, `PATCH /api/tus/{path}`, `POST /api/share/{path}`, and `GET /api/public/dl/{hash}`. - Vulnerable Parameters: `path` and `override`. - Vulnerable Functions: `stat()`, `readListing()`, `getFiles()`, `writeFile()`, `tusPostHandler()`, and `tusPatchHandler()`. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.