Arpitjain099

Hugo is a static site generator. In versions after v0.123.0 and before v0.165.0, symlinks in parent directories were not dropped during direct resource lookups, allowing path confinement to be bypassed. An attacker who can place — or who convinces a site author to place — a symlink inside a mounted directory (for example, in a locally vendored theme under themes/) can cause functions that perform direct lookups, such as resources.Get and os.ReadFile, to follow that symlink and read files outside the intended project boundaries, disclosing their contents in the built site. Themes mounted as Go modules fetched from GitHub have symlinks stripped on download and are not affected, and multi-directory walks (e.g. content/asset walking) are not affected. This issue is an incomplete-fix follow-up to GHSA-c3wq-j5vh-68rc and GHSA-fw87-fv5r-9fpw; it is fixed in v0.165.0.

Snipe-IT through 8.6.3 does not neutralize formula elements in the "unaccepted assets" acceptance report CSV export. ReportsController::postAssetAcceptanceReport builds the CSV by hand (stripping commas and joining rows manually) and, unlike the six sibling exports in the same controller, never applies LeagueCsvEscapeFormula or honors the config('app.escape formulas') setting. An authenticated low-privilege user with ordinary create/edit rights on any record whose free-text fields appear in the report (asset name/tag, company name, category, model, or assignee display name) can set such a field to a value beginning with =, +, -, @, tab, or CR. When a user with reports.view privileges requests the export (POST /reports/unaccepted assets) for a pending checkout acceptance referencing the poisoned record and opens the resulting CSV in Excel, LibreOffice Calc, or Google Sheets, the injected content is evaluated as a formula in the downloader's spreadsheet context, enabling data exfiltration (e.g., HYPERLINK/WEBSERVICE) or, on legacy Windows Excel configurations, DDE command execution. Fixed in 8.7.0.

Snipe-IT versions before 8.7.0 fail to properly scope asset acceptance report queries by company, allowing authenticated reports.view users to read pending acceptances across all companies. Attackers can access the unaccepted assets report page or CSV export to disclose cross-company inventory details and assignee names without per-row access validation.

Snipe-IT is an IT asset management application. In Snipe-IT master-branch builds after 8.6.3 (the code was never included in a tagged release), SettingsController::downloadLocationScopingReport streams the FMCS location-scoping mismatch report (GET /admin/settings/location-scoping-report.csv) through a bare fputcsv() call without applying LeagueCsvEscapeFormula, unlike the other CSV exports which honor config('app.escape formulas'). An authenticated user with ordinary create/edit rights can place a spreadsheet formula in free-text fields that appear in the report (item name, asset tag, serial, item or location company name, location name) and arrange for the record to be FMCS-mismatched so it is included in the export. When a superuser downloads the report and opens it in Excel, LibreOffice Calc, or Google Sheets with formula evaluation enabled and external-content warnings dismissed or disabled, cells beginning with =, +, -, @, tab, or CR are executed in the victim's spreadsheet context, enabling data exfiltration (e.g., HYPERLINK/WEBSERVICE) or, on Windows Excel, legacy DDE command execution. This issue is fixed in version 8.7.0.

**Name of the Vulnerable Software and Affected Versions** Grav Form plugin versions 8.0.6 through 9.1.19 **Description** The plugin determines which reCAPTCHA version to use for validation based only on the response field key present in the submitted payload. On sites configured for reCAPTCHA v3, an anonymous attacker can submit a v3 token using the v2 field name `g-recaptcha-response` instead of `token`. This forces the validation to use the v2 logic, which does not verify the expected action or apply the score threshold, resulting in a complete bypass of the bot protection. **Recommendations** Update Grav Form plugin to version 9.1.20.

**Name of the Vulnerable Software and Affected Versions** Grav versions prior to 2.0.19 **Description** A remote code execution issue exists in the Twig sort filter. The `sortFunc` wrapper in `GravExtension.php` hardcodes the `isSandboxed` argument to false, allowing the `|sort` filter to accept a plain function name within the sandbox. Because the denylist fails to include `spl autoload`, which performs a PHP include, an authenticated user with page-write permissions (`admin.pages` or `api.pages.write`) can provide a crafted payload to invoke `spl autoload` via the sort filter. This leads to arbitrary PHP execution as the web server user. **Recommendations** Update Grav to version 2.0.19 or later.

**Name of the Vulnerable Software and Affected Versions** Admidio versions prior to 5.0.12 **Description** Insufficient sanitization of album names in the photo ZIP download functionality allows authenticated users with album-creation rights to include path traversal segments in archive entry names. This enables attackers to create malicious album names containing directory traversal sequences—a technique used to access files and directories outside the intended folder—which can result in files being written outside the target directory when the recipient extracts the archive. **Recommendations** Update to version 5.0.12 or later.

**Name of the Vulnerable Software and Affected Versions** Admidio versions prior to 5.0.12 **Description** The software fails to enforce login-only module restrictions within the RSS feed endpoints for the forum and announcements modules. This allows unauthenticated attackers to retrieve forum topics and announcements by sending GET requests to the endpoints 'rss/forum.php' and 'rss/announcements.php', leading to the disclosure of titles, full post text, author names, and timestamps. **Recommendations** Update to version 5.0.12 or later.

**Name of the Vulnerable Software and Affected Versions** multer versions prior to 2.3.0 **Description** A denial of service issue exists in the middleware used for handling multipart/form-data in Node.js. A remote attacker can block the event loop by sending a multipart request containing two specially crafted text field names. The first field uses a large numeric array index to allocate a maximum-length sparse array, and a second field with a non-numeric key triggers a full-length synchronous iteration within the append-field dependency, preventing the process from handling other requests. **Recommendations** Upgrade to version 2.3.0 and configure the `limits.fieldArrayIndexLimit` option to the maximum array index required by the application.

**Name of the Vulnerable Software and Affected Versions** Foreman (affected versions not specified) **Description** An issue exists where the template revision endpoint fails to enforce object-level authorization when retrieving an audited template revision. An authenticated user with low privileges and template-related permissions, such as `view ptables`, can access historical template contents from other organizations or locations by providing the relevant audit ID. This may lead to the unauthorized disclosure of sensitive data, including configuration details, credentials, or secrets. The REST API revision endpoints are not affected by this issue. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** community.general Ansible collection (affected versions not specified) **Description** A flaw exists in the `ipa getkeytab` module where the `bind pw` parameter, used for LDAP simple-bind passwords during Kerberos keytab retrieval, lacks the `no log` declaration. This causes the password to be recorded in cleartext within the managed host's system journal or syslog, included in return values and verbose output, and displayed in Automation Controller or AWX job outputs. Additionally, the password is passed via the command line to the `ipa-getkeytab` helper using the `--bindpw` flag, making it visible in the process list to local users during execution. An attacker with access to these logs, outputs, or the process table could obtain the directory bind credential and compromise accessible accounts and objects. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, avoid using the `bind pw` parameter in the `ipa getkeytab` module until a patch is available.

**Name of the Vulnerable Software and Affected Versions** rclone versions prior to 1.75.0 **Description** The software mounts the pprof debug handler as its own router route, which bypasses the fail-closed authentication rule in the main handler. This allows unauthenticated access to the '/debug/pprof/cmdline' endpoint, enabling the retrieval of the full process argv, which may include backend credentials. **Recommendations** Update rclone to version 1.75.0 or later.

**Name of the Vulnerable Software and Affected Versions** NLTK versions prior to 3.10.3 **Description** Insufficient validation of JVM options passed through the `options` parameter in the `java()` function allows the injection of dangerous JVM flags. By supplying malicious options such as `-agentpath`, `-javaagent`, or `@argfile` to Stanford wrapper classes, an attacker can achieve arbitrary code execution. **Recommendations** Update to version 3.10.3 or later. As a temporary mitigation, restrict or avoid passing untrusted input to the `options` parameter of the `java()` function.

**Name of the Vulnerable Software and Affected Versions** phpMyFAQ versions prior to 4.1.7 **Description** The software fails to persist the WebAuthn login challenge generated by the `prepareForLogin()` function because the WebAuthn controller does not save the mutated key objects back to the database. During the login process, the anti-replay comparison is bypassed by a null guard. This allows an attacker who captures a successful WebAuthn assertion to replay it indefinitely to authenticate as a user without requiring interaction or a hardware key. **Recommendations** Update to version 4.1.7 or later.

**Name of the Vulnerable Software and Affected Versions** phpMyFAQ versions prior to 4.1.7 **Description** An issue exists where the software fails to validate the active status of an FAQ entry in the PDF export endpoint. This allows unauthenticated attackers to retrieve metadata from draft or unpublished FAQs by accessing the public PDF export route using sequential FAQ identifiers. The exposed information includes titles, solution IDs, author names, and last-update timestamps. **Recommendations** Update to version 4.1.7 or later.

**Name of the Vulnerable Software and Affected Versions** phpMyFAQ versions prior to 4.1.7 **Description** Insufficient enforcement of the `CONFIGURATION EDIT` permission on administrative API read endpoints allows any authenticated user to access sensitive administrative data. By utilizing a valid session, an attacker can retrieve information regarding LDAP server topology, bind account names, search bases, index statistics, and site analytics. The affected endpoints relate to the configuration of LDAP, Elasticsearch, OpenSearch, and the dashboard. **Recommendations** Update to version 4.1.7 or later.

**Name of the Vulnerable Software and Affected Versions** phpMyFAQ versions prior to 4.1.7 **Description** When configured to use PostgreSQL via the native pgsql PHP extension, the software declares an incorrect LIKE ESCAPE character ('=') in the Search/Database/Pgsql.php backend, while the `escapeLikeWildcards()` function escapes user input with the '|' prefix. This discrepancy makes wildcard escaping ineffective, allowing user-supplied `%` and ` ` characters to remain active as LIKE wildcards. An unauthenticated attacker can use these characters in the public FAQ search form to trigger broad pattern matches and expensive sequential scans, leading to a denial of service. This issue does not allow for SQL injection or data exfiltration as quotes remain escaped. **Recommendations** Update phpMyFAQ to version 4.1.7 or later.

Grav plugin-api before 1.0.15 contains a script injection vulnerability where the SVG sanitizer only checks for the exact extension 'svg', allowing .svgz and .xhtml files to bypass sanitization and be stored unsanitized. Attackers with api.media.write permission can upload files containing executable script payloads that execute in the site origin when accessed by administrators or visitors.

**Name of the Vulnerable Software and Affected Versions** Grav versions prior to 2.0.15 **Description** An arbitrary file write issue exists in the Blueprint dynamic-data bare-function validation due to the use of an incomplete denylist instead of a positive allowlist. Users with page-edit or blueprint-config access can trigger the `error log()` function via a data directive to append PHP payloads to web-accessible files, which can lead to remote code execution. **Recommendations** Update Grav to version 2.0.15 or later.

Grav Form Plugin before 9.1.19 fails to escape field-definition properties including prepend, append, spacer text, section text, and select option labels in form templates. Attackers with form authoring privileges can inject arbitrary HTML and JavaScript that executes for all form visitors through unescaped |raw filters and unquoted attributes.