Devnoscope

**Name of the Vulnerable Software and Affected Versions** alf.io versions prior to 2.0-M5-2606 **Description** A sandbox escape issue exists in the extension script engine of alf.io, an open source ticket reservation system. An authenticated administrator can execute arbitrary operating system commands on the server. The system uses a sandboxed Rhino environment to execute restricted JavaScript; however, the use of an unguarded injected Java object `returnClass` combined with an incomplete AST (Abstract Syntax Tree) blocklist allows the sandbox to be bypassed via Java reflection. This flaw can be triggered through the Extensions API. **Recommendations** Update alf.io to version 2.0-M5-2606.

**Name of the Vulnerable Software and Affected Versions** Gitea versions prior to 1.26.2 Forgejo versions prior to 1.26.2 **Description** An access control flaw exists in the container registry and Composer package handling. The issue allows unauthenticated remote attackers to pull private container images and view private or internal Composer package source links. This occurs because the system fails to properly enforce the private flag and lacks sufficient permission checks when rendering or serving package source metadata. An attacker can exploit this by querying Composer package endpoints or sending standard anonymous Docker/OCI pull requests to the registry API. This flaw persisted for nearly four years and potentially affects over 30,000 deployments worldwide, including approximately 4,000 production systems on major cloud platforms. Exposure of this data can lead to the disclosure of sensitive information, such as source code, secrets, and internal infrastructure details. **Recommendations** Update Gitea to version 1.26.2. Update Forgejo to version 1.26.2. As a temporary workaround, enable the `REQUIRE SIGNIN VIEW` configuration setting to enforce authentication for all content access.