Mistz1

Several components that resolve filesystem paths or expand search patterns do not consistently confine the resolved path to the intended root directory. This occurs in a file-search agent middleware that validates a starting directory but fails to validate the search pattern or the resolved target of matched files, allowing glob patterns and symlinks to access files outside the configured root. Additionally, prompt and chain/agent-configuration loaders resolve path fields without confining them to a trusted base or rejecting symlink targets. Furthermore, path-prefix authorization checks use string prefix comparison without a path-segment boundary, which allows sibling paths sharing the same prefix to be accepted. If these components process path values, search patterns, or workspace contents influenced by an untrusted source, such as an LLM acting on untrusted input, it can lead to the disclosure of files outside the intended boundary.

A security validator bypass exists in the Python Code node involving the Abstract Syntax Tree (AST), which is a tree representation of the abstract syntactic structure of source code. An authenticated user with permissions to create or modify workflows can bypass this validator to access the task executor module namespace. This issue specifically affects self-hosted instances with the Python Task Runner enabled. If the `N8N BLOCK RUNNER ENV ACCESS` variable is configured to allow access, this could lead to the disclosure of environment variables accessible to the task runner process.

A SQL injection issue in the `create sqla query()` function allows authenticated users to execute arbitrary SQL commands against the backend database. This occurs specifically in Oracle deployments using the default `json meta` plugin. The flaw exists because attacker-controlled filter keys and values are interpolated directly into `sqlalchemy.text()` using Python string formatting, which bypasses parameterization. This can be exploited via the 'GET /dids/<scope>/dids/search' endpoint. Successful exploitation may lead to full database compromise, including the extraction of password hashes, authentication tokens, and managed data identifiers, as well as the potential modification of database contents.

An issue exists in the `FilterEngine.create postgres query()` function where authenticated users can execute arbitrary SQL against the PostgreSQL metadata database. This occurs when the `postgres meta` metadata plugin is configured, as attacker-controlled filter keys and values are interpolated directly into raw SQL strings using Python `.format()`, which are then processed as trusted syntax by `psycopg3`'s `sql.SQL()`. The flaw is accessible via the 'GET /dids/<scope>/dids/search' endpoint. Depending on database privileges, this can lead to the exposure of sensitive tables (such as `identities`, `tokens`, `accounts`, `rse settings`, and `rules`), modification or deletion of metadata, access to server-side files, or remote code execution through the `COPY ... FROM PROGRAM` feature. Password hashes may also be extracted and cracked due to the use of single-iteration SHA-256 without a Key Derivation Function (KDF), a method used to strengthen passwords before hashing.

The software features an Insecure Direct Object Reference (IDOR) in the video proxy endpoint. Any authenticated user can access video content belonging to other users by exploiting a missing authorization check. Specifically, the `model.GetByOnlyTaskId(taskID)` function queries tasks using only the `task id` without verifying user ownership, while other task lookups correctly enforce ownership using `model.GetByTaskId(userId, taskID)`. This allows an attacker to bypass tenant isolation for generated media assets and potentially access sensitive data, including upstream response headers and API keys used for contacting AI providers like Google Gemini and OpenAI. The vulnerable API endpoint is `GET /v1/videos/:task id/content`. The vulnerable parameter is `task id`. The vulnerable handler is `controller.VideoProxy`. An attacker can exploit this by sending a request to the affected API endpoint with a known `task id` belonging to another user.

ormar, an async mini ORM for Python, has a Pydantic validation bypass issue in its model constructor. This allows unauthenticated users to skip all field validation by injecting " pk only ": true into a JSON request body. The injection of " pk only ": true allows bypassing type checks, constraints, and other validation rules, leading to the persistence of unvalidated data in the database. A secondary issue involves the " excluded " parameter, which can be used to selectively nullify arbitrary model fields during construction. This affects the recommended FastAPI integration pattern, potentially enabling privilege escalation, data integrity violations, and business logic bypass. The root cause is the direct extraction of " pk only " from user-supplied keyword arguments before validation occurs. The ` pk only ` flag was originally intended for internal optimization but is accessible to external callers. The affected entry points include FastAPI routes using ormar models as request body parameters, as well as direct calls to `Model.objects.create(**user dict)` and `Model(**user dict)`.

Statmatic is a Laravel and Git powered content management system (CMS). Authenticated Control Panel users may, under certain conditions, obtain elevated privileges without completing the intended verification step. This can allow access to sensitive operations and potentially lead to privilege escalation, depending on the user’s existing permissions.

calibre is an e-book manager for viewing, converting, editing, and cataloging e-books. A HTTP Response Header Injection exists in the calibre Content Server for versions before 9.4.0. An authenticated user can inject arbitrary HTTP headers into server responses through an unsanitized `content disposition` query parameter. This occurs in the `/get/` and `/data-files/get/` API endpoints. The issue is exploitable by any authenticated user, potentially through a crafted link. All users running the calibre Content Server with authentication enabled are affected.