Cataliniovita-Snyk

**Name of the Vulnerable Software and Affected Versions** Craft CMS versions 5.0.0-RC1 through 5.9.20 Craft CMS versions 4.0.0-RC1 through 4.17.13 **Description** An authorization issue exists where a forced folder move can delete a conflicting destination folder even if the user lacks the required destination delete permissions. The `craftcontrollersAssetsController::actionMoveFolder()` function allows moving an asset folder into a destination parent folder. When a folder with the same name already exists at the destination, the action can be executed with the `force` parameter set to `true` to overwrite the destination. The system fails to verify `deleteAssets` permissions on the destination volume or the conflicting folder, allowing the deletion of the destination folder and its contents. This can lead to asset loss, broken references in entries and fields, and operational disruption. **Recommendations** Update Craft CMS to version 5.9.21. Update Craft CMS to version 4.17.14.

**Name of the Vulnerable Software and Affected Versions** Craft CMS versions 4.0.0-RC1 through 4.17.13 Craft CMS versions 5.0.0-RC1 through 5.9.20 **Description** An authorization issue exists in the `AssetsController::actionReplaceFile()` function. The system allows replacing a target asset file using another existing asset as the source. When both `assetId` and `sourceAssetId` are provided, the permission check is only performed against the target asset, bypassing the deletion check for the source asset volume. Consequently, an authenticated user with replace permissions in one volume can delete assets in another volume where they lack delete permissions, provided they have the `sourceAssetId`. This can result in data loss and broken content references. **Recommendations** Update Craft CMS versions 4.0.0-RC1 through 4.17.13 to version 4.17.14. Update Craft CMS versions 5.0.0-RC1 through 5.9.20 to version 5.9.21.

**Name of the Vulnerable Software and Affected Versions** Mongoose versions prior to 6.13.9 Mongoose versions prior to 7.8.9 Mongoose versions prior to 8.22.1 Mongoose versions prior to 9.1.6 **Description** A flaw in the `sanitizeFilter` query sanitization mechanism allows it to be bypassed using the `$nor` operator. When `sanitizeFilter` is active, Mongoose typically wraps query operators in `$eq` to neutralize them. However, `$nor` was not recursively sanitized. Since `$nor` accepts an array and arrays do not trigger the `hasDollarKeys()` function, malicious operators such as `$ne`, `$gt`, or `$regex` can be injected within a `$nor` clause. This can lead to authentication bypass, unauthorized data access, or data exfiltration in applications that pass unsanitized user-controlled input directly into query methods and rely on `sanitizeFilter` for protection. **Recommendations** Update to version 6.13.9 or later. Update to version 7.8.9 or later. Update to version 8.22.1 or later. Update to version 9.1.6 or later. As a temporary workaround, delete `$nor` keys, use an additional schema validation library, or implement middleware to strip `$nor` from query filters.

**Name of the Vulnerable Software and Affected Versions** Dify versions prior to 1.11.2 **Description** Dify, an open-source LLM app development platform, contains a stored cross-site scripting (XSS) issue when rendering Mermaid diagrams within chats. The issue stems from Dify’s default Mermaid configuration utilizing a `securityLevel` of `loose`, which permits the execution of potentially unsafe content. **Recommendations** Update to version 1.11.2 or later.