Iaohkut-From-Nightwolf-Team

An authenticated user with resource-management privileges can exploit the resource-management project resolution process by providing a crafted project identifier. Because the system fails to validate that these identifiers are safe path components, the path resolution can escape the shared-projects directory, allowing the user to enumerate directory names elsewhere on the server and disclose filesystem layout information.

An authorization flaw allows namespaced Policy authors to access resources in other namespaces. This occurs when templating `generate.clone` or `cloneList` namespace values. An attacker can annotate a triggering ConfigMap, causing the background-controller to copy a sensitive ConfigMap from a victim namespace into the attacker's namespace, resulting in cross-tenant data disclosure.

An issue exists in the unauthenticated `get-view-only-bundle` RPC (Remote Procedure Call) that returns all share-link rows for a file, regardless of whether the caller authenticated with a single scoped share link. An attacker possessing a restrictive link can retrieve secret IDs, page scopes, comment permissions, and inspection permissions of other links. This information can be used to replay a more permissive token to access page data not included in the original share.

A memory accumulation issue exists in the `CurlAsyncHTTPClient` component. Remote attackers can trigger a denial of service by sending a gzip-encoded decompression bomb, which is a highly compressed file that expands to a massive size when decompressed. This causes memory to accumulate without size limits, leading the application process to be terminated due to out-of-memory conditions.

The software fails to limit the number of query string fields in the `HTTPServerRequest. init ` function. This allows remote, unauthenticated attackers to send GET requests containing thousands of query parameters, leading to event-loop stalling. This condition degrades response times for all clients sharing the same IOLoop, which is the main event loop that handles all asynchronous networking tasks in the application.

The software fails to redact plaintext datasource credentials when broadcasting external table updates to the Builder collaboration websocket room. Users with Builder access can intercept unredacted datasource objects, which may contain sensitive information such as database passwords and API keys, by observing table save or delete operations.

A path traversal issue exists in the `StaticFileHandler` that allows the system to follow symbolic links within the static root without verifying if the resolved target remains inside that directory. This allows unauthenticated attackers to access files outside the static directory, such as configuration files, private keys, and application secrets, provided a symbolic link pointing to those locations exists within the static root.

The Maven Wrapper manager contains a flaw that allows remote code execution. An attacker can execute arbitrary shell commands by providing a malicious value for the `distributionType` parameter within the maven-wrapper.properties file. This occurs when Renovate processes Maven Wrapper updates while operating in `binarySource=docker` mode, as the `distributionType` values are not properly escaped.

The Mix manager contains a flaw when processing private dependencies with unescaped organization parameters. An attacker can inject shell metacharacters via malicious package names to execute arbitrary commands as the Renovate user when operating in `binarySource=docker` mode. Command injection is a security issue where an attacker executes arbitrary operating system commands on a vulnerable server.

The `manager/gradle-wrapper` module fails to escape the `distributionUrl` value read from the `gradle/wrapper/gradle-wrapper.properties` file before calling the Gradle Wrapper CLI. In self-hosted deployments using `binarySource=docker` and where `allowedUnsafeExecutions` includes `gradleWrapper`, a repository containing a crafted `distributionUrl` (such as one containing shell metacharacters and commands) can lead to arbitrary command execution as the Renovate user during a Gradle Wrapper update.

A command injection issue exists in the gomod manager when processing unescaped `depName` parameters during import-path update commands while operating in `binarySource=docker` mode. This occurs during Go module major version updates when `postUpdateOptions gomodUpdateImportPaths` is enabled, allowing attackers to inject shell metacharacters via malicious dependency names to execute arbitrary commands as the Renovate user.

An issue exists in the internal helper used to escape log token values. The software fails to neutralize Unicode line separator characters U+0085 (Next Line), U+2028 (Line Separator), and U+2029 (Paragraph Separator). An unauthenticated remote client can inject these characters into an attacker-controlled log token, such as a Basic auth username processed via the `remote-user` token. This allows for log forging, where Unicode-aware downstream log processing systems split a single request log into multiple logical records.

The embedded Redis bootstrapper contains an insecure temporary file flaw. The system writes startup configuration to a fixed, predictable, and world-writable path `/tmp/redis.conf`, creating the file only if it does not already exist and failing to validate it during subsequent boots. A local unprivileged user can pre-create this file with malicious Redis directives. While Faktory overrides the `unixsocket`, `dir`, and `logfile` options, other directives such as `bind`, `protected-mode`, `requirepass`, and `loadmodule` remain attacker-controlled. This allows an attacker to expose the job queue over an unauthenticated network port or use the `loadmodule` directive to execute arbitrary native code within the root-owned Redis process, resulting in privilege escalation from a local unprivileged user to root.

An unauthenticated denial of service exists where a single malformed command can crash the entire process. The server uses a line-based wire protocol where several command handlers perform slicing or indexing on received lines at fixed offsets without verifying the presence of a payload. Sending a bare verb without a payload—such as PUSH, ACK, FAIL, BEAT, PUSHB, or QUEUE—triggers a Go slice or index out-of-range panic. Since the command-dispatch path lacks a `recover()` function, an unrecovered panic in a handler goroutine terminates the entire Go process, disconnecting all clients, workers, and in-flight jobs. The attack requires only a connection to the command port and the completion of the handshake, requiring no credentials if no password is configured.

Two domain-ownership flaws exist when the SSO plugin is active. If domain verification is disabled, automatic organization assignment accepts unverified provider domains. This allows an authenticated organization owner or administrator to register an SSO provider for any domain, causing users with matching email domains to be added to the attacker's organization with default member permissions. If domain verification is enabled, a race condition occurs between the 'verify-domain' and 'update-provider' endpoints, which can apply a completed DNS proof to an incorrect domain. When combined with implicit account linking, this allows an attacker-controlled identity provider to be linked to an existing user account. The organization plugin must also be enabled for the organization assignment path to be exploited.

An open redirect weakness exists in the `SsoController::sanitizeReturnTo()` function. The function fails to account for browsers that normalize backslashes to slashes in http or https schemes. Consequently, a `returnTo` value containing a backslash, such as `/evil.com`, can bypass the security guard and be interpreted by the browser as a protocol-relative URL. This allows an attacker to use the `returnTo` parameter during a legitimate OAuth login flow to redirect an authenticated user to a malicious site for phishing purposes.

An authorization bypass exists in the `BlueprintPathResolver::resolveUserScope()` function. The system checks the account's super-admin ACL flag `access.api.super` instead of validating the actual scope of the provided API key. An attacker with an API key scoped only to `api.media.write` created from a super-admin account can bypass authorization. This allows the attacker to use the 'POST /blueprint-upload' or 'GET /blueprint-files' endpoints to write files into another user's scope within the shared `user/accounts/` directory (limited to image extensions by `assertSafeExtension()`) and browse that scope's file listing, even without the `api.users.write` permission.

The Grav API plugin fails to enforce authorization requirements within the `MenubarController::executeAction()` function. While the 'GET /menubar/items' endpoint correctly filters items, the 'POST /api/v1/menubar/actions/{plugin}/{action}' endpoint only verifies the basic `api.access` permission and ignores the `authorize` field registered by a plugin for that action. Consequently, any authenticated user with `api.access` can execute privileged menubar actions, bypassing intended authorization. This issue affects first- or third-party plugins that rely on documented authorize semantics.

An issue exists in the `userPassesAuthorize()` function within `AbstractApiController.php` where the system fails to verify the API key scopes of the calling request. Instead, it relies on the account's raw super-admin flag and Access Control List (ACL) grants. This allows an authenticated attacker using a scoped API key from a privileged account to bypass scope restrictions and access protected UI metadata and item definitions, such as sidebar, menubar, and widget items, as well as users-list columns, row-actions, and filter-tabs, leading to information disclosure.

A stored cross-site scripting issue exists in the `Security::detectXss()` function located in system/src/Grav/Common/Security.php. The XSS detection patterns utilize the PCRE /u (UTF-8) modifier, which causes `preg match()` to return false for all patterns if a single invalid UTF-8 byte is present in the page content. This behavior allows the save-time XSS safety gate `Validation::checkSafety()` to be bypassed. An authenticated attacker with page-edit permissions, who lacks the `security.xss whitelist` privilege, can store malicious JavaScript that executes in the browser of any visitor viewing the affected page.