B1Gn0Se

**Name of the Vulnerable Software and Affected Versions** fastify versions 4.0.0 through 5.12.1 **Description** An unauthenticated attacker can bypass authentication hooks and break prefix encapsulation by sending a malformed URL. The internal not-found router for encapsulated handlers dispatches malformed paths through a single shared handler pointer before URL decoding, which ignores the prefix and skips the normal lifecycle of the selected handler. This allows a request sent under one plugin prefix to be routed to the custom not-found handler of a different sibling plugin, potentially allowing the attacker to reach an authentication-protected private fallback and read its full response. **Recommendations** Upgrade to fastify version 5.12.2 or later.

**Name of the Vulnerable Software and Affected Versions** File Browser versions prior to 2.63.20 **Description** An issue exists where the software fails to honor the `createUserDir` isolation during proxy and hook authentication auto-provisioning paths. This allows attackers possessing valid upstream-authenticated credentials to exploit the server root scope assignment to read, modify, delete, and share files belonging to other users. **Recommendations** Update to version 2.63.20 or later.

**Name of the Vulnerable Software and Affected Versions** Traefik versions 3.7.0 through 3.7.7 **Description** A path traversal issue exists in the Kubernetes Ingress NGINX provider's RewriteTarget middleware, which is generated from the `nginx.ingress.kubernetes.io/rewrite-target` annotation. When an Ingress path utilizes a regex that captures attacker-controlled text without requiring a path separator, a crafted request can be rewritten to a dot-segment traversal path. Because the system forwards the request without post-replacement normalization validation, a backend that normalizes dot segments may resolve the path to a protected endpoint. This allows an attacker to bypass route-level authentication mechanisms such as BasicAuth, DigestAuth, or ForwardAuth. **Recommendations** Update to version 3.7.8.