Everping

An authentication bypass exists in the SAML identity-provider intent callback. The system verifies the assertion signature using the provider specified in the request URL but resolves the user from the login intent without ensuring they match. This allows attackers with organization-administrator permissions to register a SAML provider using their own signing key to gain authenticated sessions as any user linked to another SAML provider on the instance, regardless of their organization.

A regression in the `SHELL SAFE COMMAND PATTERN` allows ampersands to be used in custom Docker Compose build, start, and pre/post-deployment command fields. This enables an authenticated team member to perform shell command injection, resulting in the execution of arbitrary commands on the host system.

A missing authorization flaw exists in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying if the creator of the ClusterLogForwarder has the necessary permissions to use those credentials. This allows a delegated editor to exfiltrate ServiceAccount tokens and escalate privileges.

An issue exists in the `File::prohibitWrappers()` function where the use of `parse url()` to detect stream wrappers can be bypassed. When an input contains three or more slashes after the scheme (e.g., `phar:///path/file.phar/inner`), `parse url()` returns a boolean `false` instead of the scheme string, allowing the check to be skipped. This enables the `IOFactory::load()` function to process phar wrappers. On PHP 7.x, this can lead to remote code execution (RCE) because the system automatically deserializes phar metadata via `is file`, triggering the ` wakeup()` and ` destruct()` magic methods of attacker-controlled objects. On PHP 8.x, the impact is reduced to a phar wrapper file read primitive, as automatic metadata deserialization was removed; RCE would only occur if the downstream consumer calls `Phar::getMetadata()`.

A flaw exists in the multi-agent teams system where an import sink in `praisonai/templates/tool override.py` remains unguarded. This allows remote attackers to trigger arbitrary code execution via the `POST /v1/recipes/run` endpoint by providing a `recipe` value that points to a local absolute path or a GitHub repository. The system executes the `exec module()` function on a `tools.py` file placed next to `TEMPLATE.yaml`. By default, no authentication or environment opt-in is required for this action.