Byteme.Red

ICEcoder versions through 8.1 contain a path traversal vulnerability in the file-control endpoint due to a logic error in the document-root confinement check. The File::check() validation function compares realpath() to boolean true, which never succeeds, allowing authenticated attackers to submit traversal sequences or absolute paths in the file parameter to read, write, or delete files outside the configured document root.

ICEcoder versions through 8.1 fail to properly validate the oldFileName parameter in file move and rename operations, allowing authenticated users to relocate files from outside the document root. Attackers can use path traversal sequences in oldFileName to move files writable by the PHP process into the web-accessible project directory, disclosing file contents and deleting originals.

ICEcoder through 8.1 passes an unescaped filesystem path into a shell command in lib/properties.php, allowing authenticated users to inject OS commands through directory names. Attackers can create directories with shell metacharacters in their names and access the Properties function to execute arbitrary commands as the web-server user via popen().

**Name of the Vulnerable Software and Affected Versions** BookStack versions prior to 26.05.4 **Description** Broken access control allows authenticated API users with image-update or image-delete permissions to manipulate avatars of other users. This occurs due to missing content-type restrictions in the Image Gallery API endpoints. An attacker can provide a user avatar's ID to the API controller, which bypasses the gallery and drawio restrictions typically enforced by the web controller. If the `uploaded to` field of the avatar matches a page ID that the attacker can access, the authorization check is bypassed, enabling the attacker to rename, replace, or delete the target avatar without needing user-management permissions. **Recommendations** Update BookStack to version 26.05.4 or later.

**Name of the Vulnerable Software and Affected Versions** sysPass version 3.2.11 **Description** An insecure direct object reference occurs due to missing authorization checks in the `AccountFileController`. This allows an authenticated attacker to access account file attachments for which they lack Access Control List (ACL) permissions. By providing arbitrary numeric file IDs through the download, view, delete, upload, and list actions, an attacker can enumerate and manipulate any attachment within the vault, bypassing account-level access controls. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** sysPass versions prior to 3.2.12 **Description** Authenticated users possessing the `PUBLICLINK CREATE` profile flag can trigger unauthorized decryption and persistent storage of any vault account password. This occurs due to missing AccountAcl checks during the public link creation process. An attacker can call the 'saveCreateFromAccountAction' endpoint, causing the `getDataForLink()` function in AccountService to load arbitrary target accounts without `AccountFilterUser` restrictions. This process decrypts credentials using the session master key and serializes cleartext passwords into the Vault storage within the PublicLink database row, which may allow unauthenticated retrieval if the resulting link hash is obtained. **Recommendations** Update to a version newer than 3.2.11. Restrict the use of the `PUBLICLINK CREATE` profile flag for users until the update is applied.

**Name of the Vulnerable Software and Affected Versions** sysPass versions prior to 3.2.12 **Description** A missing object-level authorization issue exists in the JSON-RPC API. This allows holders of API tokens to enumerate account metadata, overwrite passwords, and delete accounts across the entire vault, bypassing per-account access controls. The flaw occurs because the `AccountController` methods `viewAction()`, `editAction()`, `deleteAction()`, and `editPassAction()` can be invoked without the required `AccountFilterUser` checks, enabling the modification or deletion of accounts outside the permissions assigned to the token. **Recommendations** Update sysPass to a version newer than 3.2.11.