Kah-Ja

An issue exists where the application stores attacker-chosen absolute SSL and SSH file paths during connection creation or updates. When a connection is removed or duplicated, the cleanup routine passes these stored paths to the `fs.unlink()` function without path restrictions. A user with `createOwn` and `deleteOwn` permissions can store a target file path in a connection and then delete that connection to trigger the deletion of the referenced file. If the application is running with root privileges (uid 0), an attacker can delete critical files such as `/code/.env` or application source code, leading to service disruption and loss of integrity.

In Docker Compose deployments with SAML enabled, the application may render `SAML SIGNED ASSERTIONS` and `SAML SIGNED RESPONSES` as empty values. This behavior overrides secure defaults and disables signature requirements. An unauthenticated attacker can exploit this by sending a forged unsigned response to the SAML assertion consumer endpoint using an existing user email address to hijack that user's session. If a superadmin account is targeted, it can lead to a full account takeover. This issue does not affect default Fargate or Helm deployments, nor does it allow user creation if SAML user creation is disabled.

The `SQLPlugin.Call` function in `vql/parsers/sql/sql.go` fails to enforce `FILESYSTEM READ` or `NETWORK` checks before passing a caller-controlled `connstring` to `sql.Open`. This allows arbitrary outbound database connections. A rogue MySQL server can leverage attacker-controlled connection options to enable local-infile access, allowing it to request files readable by the Velociraptor server process, including root-readable files if the process is running as root. Additionally, a low-privilege analyst with `ANY QUERY` permissions can bypass the `FILESYSTEM READ` check by using the zero-permission data accessor and the `ATTACH DATABASE` command to create files.

Four authentication helpers in the API and socket layer accept session JSON Web Tokens (JWT) signed with `CB SECRET`, including known, weak, or default values. This occurs within the session JWT fallback in `server/modules/verifyToken.js`, `verifyUser.js`, `getUserFromToken.js`, and `socketManager.js`. An attacker who knows the symmetric secret can forge an HS256 token to impersonate any target user ID, bypassing password and two-factor authentication to gain full account takeover and exercise the user's privileges across the entire application. This issue specifically affects stock source or repository Docker Compose deployments that retain the default `CB SECRET`, as well as any installation using a known or weak secret. Bare containers where `CB SECRET` is undefined are not affected.

Chart share and embed tokens are signed using the `CB SECRET` variable, which may contain known or default values in certain Docker Compose installations. This allows an unauthenticated attacker who knows the `CB SECRET` to forge a Chart-subject token for private charts that have been shared at least once. The issue exists in the chart share-token verification and filter-access routes, where sequential integer ids are accepted without a legitimate share link. Consequently, an attacker can enumerate these ids to read arbitrary private chart data, such as `chartData`. Token expiry and revocation mechanisms are ineffective if the secret is compromised.

An issue exists in the shared project permission check where the system trusts a caller-controlled `team id` without verifying if the target project belongs to that team. This occurs within project routes and authorization checks that accept user-controlled project identifiers. An authenticated user with an owner or admin role on their own team can submit a victim project ID along with their own `team id` in the request body. Because the update path performs mass-assignment of the request body without a project field allow-list, the attacker can re-parent the victim project to their own team. This allows the attacker to gain full read and write access, remove password protection, expose the project publicly, or perform cross-tenant deletion via the shared delete route.

An issue exists in the way date-typed MongoDB variables are handled when placed inside quoted query placeholders. These variables are inserted as unescaped strings, whereas strings, numbers, and Booleans are safely escaped or coerced. This affects public, shareable, or embedded charts backed by MongoDB that use date-variable substitution. An unauthenticated user can provide a crafted URL filter to a reachable chart, allowing the date value to break out of the quoted literal and alter the query logic. This creates a Boolean oracle based on the returned row count, enabling the read-only extraction of any field within the queried collection, including sensitive data not displayed by the chart, on a character-by-character basis.

The application allows anonymous access to the `GET /user/{username}` endpoint. This endpoint renders six user-editable profile fields—`firstname`, `lastname`, `competences`, `openarea`, `teach`, and `diplomas`—without server-side sanitization and with auto-escaping disabled. An attacker with the ROLE STUDENT role, which can be obtained via self-registration if enabled, can inject malicious HTML into their own profile. This stored content executes in the browser of any visitor, including administrators, who views the public profile link, potentially leading to account takeover through the exfiltration of session data, JWT (JSON Web Tokens), or `localStorage` data.

An SQL injection issue exists in the '/realtime/v1/runs' endpoint. The system concatenates the unescaped `tags` query parameter into the ElectricSQL shape where clause, which bypasses the `runtimeEnvironmentId` tenant guard. Authenticated attackers with a project API key possessing the `read:runs` scope can append boolean conditions to stream TaskRun records, including payloads and metadata, from all organizations sharing the same self-hosted instance.

A missing origin check in the `wm agent upgrade` function allows enrolled agents to issue `upgrade custom` commands using an attacker-controlled `file path` variable. This allows attackers to inject an `upgrade custom` message over the agent channel to read arbitrary files with root privileges, potentially exfiltrating sensitive files such as `/etc/shadow` and `client.keys`.

An issue in the GraphQL `/metadata` endpoint allows the `connectedAccounts` query to return `connectionParameters` from `ConnectedAccountDTO` for all connected accounts within a workspace. This occurs because the field is not hidden and the lookup process fails to enforce the identity of the calling user or account visibility. Consequently, a standard workspace member can obtain plaintext IMAP, SMTP, and CalDAV passwords of other members, potentially allowing unauthorized access to emails, calendars, and the ability to reset third-party accounts. Workspaces using only Google and Microsoft OAuth are not affected.

An issue exists where the `IntakeIssuePublicViewSet.create` function writes `description html` via `Issue.objects.create()` without utilizing the `validate html content` function from the nh3 library. This allows any authenticated user, including those without workspace memberships, to inject arbitrary HTML into projects with a published DeployBoard and enabled intake. When a project member or viewer interacts with a closed intake item by clicking a planted link, a parser bypass in TipTap involving `javascript:` and a `target=" self"` click handler executes JavaScript within the viewer's session to exfiltrate a long-lived API token.

Staff members assigned the Author role can delete posts and pages that they did not create.

Insufficient sanitization of data within the JSON-LD HTML tag emitted by the `{{ghost head}}` helper allows an authenticated user with limited privileges to inject unescaped content. This content is rendered as a script on the published page, which could lead to the compromise of a staff user's admin session upon viewing the affected page.

An issue exists where the player renders caption cue text into `innerHTML` without proper escaping. This allows a user with content authoring permissions to upload a subtitle file (such as WebVTT or DFXP) containing malicious HTML or JavaScript. When a viewer enables captions for the affected event, the script executes within the Opencast origin in the viewer's browser session. This affects anonymous viewers as well as authenticated staff, potentially leading to session theft, CSRF-token theft, and unauthorized actions against the Opencast REST API. The issue is triggered when the player processes caption tracks served via the `/search/episode.json` endpoint. The vulnerable behavior occurs because the caption plugins, enabled by default, append the cue text directly to the ` captionsContainer.innerHTML` sink without sanitization.

The `/api/download` endpoint in `packages/server/routes/api.js` improperly handles the `port` query parameter, passing it to the `socket.connect(port, host)` function and returning the resulting error message as text/html without a Content Security Policy. This allows a reflected value to execute in the manager origin when a logged-in operator follows a crafted link. Additionally, the token cookie in `packages/ui/src/store/modules/query.js` lacks HttpOnly, Secure, and SameSite attributes, enabling a script to read the token and trigger the `autofillform()` event in `packages/server/socket.js`. This event returns a decoded JSON Web Token (JWT), which may contain the cleartext ServerQuery password, potentially leading to operator-session hijacking and full control of the managed TeamSpeak server if administrative credentials are used. A valid operator session and user interaction are required for exploitation.

Chamilo LMS stores private `Message.content` without server-side sanitization and renders it as HTML in assets/vue/views/message/MessageShow.vue and public/main/template/default/message/view message.html.twig. An authenticated low-privilege user, such as a student, can send crafted message content to an administrator. The content executes in the recipient's browser upon opening the inbox or message view, which can expose session credentials or allow actions to be performed as the administrator.

The automatic image-download feature fails to validate paths when processing `file://` URLs within `img` tags of a note. This allows an authenticated user to disclose arbitrary files readable by the process by saving a text note with a source like `file:///etc/passwd`, which the system then stores as a note attachment. Additionally, targeting an unbounded source such as `/dev/zero` can lead to uncontrolled memory allocation, resulting in a server process crash. This functionality is enabled by default and accessible via the web UI, the ETAPI, the web clipper, and note imports, requiring an authenticated session or an ETAPI token.

An arbitrary file write issue exists when the sql-log plugin is enabled. An authenticated user can utilize path traversal sequences—a technique used to access files and directories outside the intended folder—via the `ns` parameter in the 'plugins/sql-log.php' endpoint to write arbitrary .sql files with controlled content to any writable directory on the host.

The server-side Send Email integration block allows arbitrary reading of local files on the server. The issue occurs because the `parseAttachments` helper returns a supplied value as a filesystem path if it does not start with the application's base URL, rather than enforcing an http or https URL. Since the Nodemailer transport is initialized without `disableFileAccess` or `disableUrlAccess` enabled, an absolute server path provided via a typebot variable is read from the local filesystem and sent as an attachment. A registered user can exploit this by publishing a bot that attaches sensitive files, such as `/etc/passwd` or `/proc/self/environ`, and sends them to a controlled email address. This allows the retrieval of process environment secrets, including the database connection string and credential encryption key, without requiring administrative privileges or victim interaction.