Florian Kabashi

MLflow before 3.18.0 using the FileStore backend contains a path traversal vulnerability that allows unauthenticated remote attackers to write files outside the intended run directory by supplying a malicious model id parameter to the log outputs API. Attackers can exploit the unvalidated model id containing ../ sequences via the POST /api/3.0/mlflow/runs/outputs endpoint to create directories and write a meta.yaml file at arbitrary filesystem locations, limited only by the server account's permissions. FileStore was the default backend before 3.7.0 and is opt-in afterward through MLFLOW ALLOW FILE STORE.

ZoloBlocks for WordPress contains a missing authorization issue resulting from an incorrectly configured access control security level. Specifically, a missing capability check on a function allows unauthenticated attackers to perform unauthorized actions.

CoopCycle coopcycle-web 5.6.0 before 6.20.0 contains a missing authentication vulnerability that allows unauthenticated attackers to forge Zelty webhook events because the x-zelty-hmac-sha256 HMAC signature is never verified. Attackers can POST forged dish, menu, option and order-status events to /api/zelty/webhook/* endpoints to toggle restaurant products and alter order preparation states.

Authenticated users can upload PHP files through the '/upload/send/' endpoint. By submitting base64 encoded `fileContent` with a `.php` `fileName` into the web root, an attacker can execute arbitrary code with the privileges of the web server user.