Neo-Ai-Engineer

An unauthenticated arbitrary file write issue exists in the 'aVideoEncoderChunk.json.php' endpoint. Remote attackers can use HTTP PUT requests to write up to 4 GB of arbitrary content to the server filesystem without authentication. This can lead to disk space exhaustion causing denial of service, poisoning of the video encoding pipeline, or remote code execution when combined with local file inclusion.

An issue exists during user registration where the software fails to sanitize the `phone` field. This allows unauthenticated attackers to perform a stored cross-site scripting attack by injecting malicious JavaScript that persists in the database. The script executes in the browser session of an administrator when they visit the users management page, as the unsanitized value is rendered using innerHTML.

When configured with proxy authentication (`auth.method=proxy`), the software improperly trusts upstream identity headers without validating that requests originate from a trusted proxy. An unauthenticated attacker with direct access to the server can impersonate any user, including the administrator, by sending a forged HTTP header. Furthermore, providing a non-existent username in the header triggers the automatic creation of a new user account, allowing unauthorized account provisioning. This leads to full administrative account takeover and complete compromise of server-side file management.

The application registers a custom `org.traccar.client://config` deep-link scheme that allows the silent modification of persistent configuration settings without user confirmation or notification. An attacker can use a crafted link delivered via SMS, email, a webpage, or another app to hijack GPS tracking parameters, including the server URL, device ID, accuracy, distance, and interval. This enables the covert redirection of real-time GPS telemetry to an attacker-controlled server at maximum precision and frequency, with the changes persisting across device restarts.

Name of the Vulnerable Software and Affected Versions Vite versions 7.1.0 through 7.3.1 and 8.0.0 through 8.0.4 Description Vite, a frontend tooling framework for JavaScript, allows retrieval of files blocked by `server.fs.deny` (such as .env and *.crt files) with HTTP 200 responses when specific query parameters like ?raw, ?import&raw, or ?import&url&inline are appended to the request. This occurs when the Vite dev server is exposed to the network and sensitive files are both allowed by `server.fs.allow` and denied by `server.fs.deny`. Recommendations Vite versions 7.1.0 through 7.3.1 should be updated to version 7.3.2 or later. Vite versions 8.0.0 through 8.0.4 should be updated to version 8.0.5 or later.

Name of the Vulnerable Software and Affected Versions Directus versions prior to 11.16.1 Description Directus is susceptible to an open redirect issue through the `redirect` parameter on the `/admin/tfa-setup` page. An administrator who has not configured Two-Factor Authentication (2FA) may be redirected to an attacker-controlled URL after completing the 2FA setup process, as the application lacks validation of the redirect destination. This could be leveraged in phishing attacks targeting Directus administrators. Recommendations Update to version 11.16.1 or later.

Name of the Vulnerable Software and Affected Versions hoppscotch versions prior to 2026.3.0 Description hoppscotch, an open source API development ecosystem, contains a DOM-based open redirect issue in the '/enter' page. The `redirect` query parameter is used to construct a URL and redirect the user without validation. Recommendations Update to version 2026.3.0 or later.

Sensitive instance management API endpoints are exposed without authentication. Unauthenticated attackers can query endpoints such as '/api/v1/consolidated-api/view' and '/api/v1/tenants/current' to retrieve configuration metadata, license information, and unsalted SHA-256 hashes of admin email domains for reconnaissance and targeted attack planning.

Chamilo LMS is a learning management system. A flaw exists in the H5P Import feature that allows authenticated users with the Teacher role to achieve Remote Code Execution (RCE). The system’s validation of H5P packages only confirms the presence of the `h5p.json` file, failing to block potentially harmful files like `.htaccess` or PHP files with alternative extensions. An attacker can upload a specially crafted H5P package containing a webshell and a `.htaccess` file. The `.htaccess` file enables PHP execution for `.txt` files, effectively bypassing security controls. The **API endpoint** involved is the H5P Import feature. The vulnerable component is the H5P package validation process, specifically the function that checks for the `h5p.json` file. The attacker manipulates the `h5p.json` file and associated files within the H5P package.

Cloud CLI, a desktop and mobile UI for Claude Code, Cursor CLI, Codex, and Gemini-CLI, contains a flaw due to OS Command Injection via WebSocket Shell. The `projectPath` and `initialCommand` parameters in the `server/index.js` file are directly incorporated into a bash command string without proper sanitization, allowing for arbitrary OS command execution. A further injection point exists through the unsanitized `sessionId`. This issue allows unauthenticated remote code execution on any instance running with the default configuration. The root cause is the insecure default JWT secret combined with a WebSocket authentication function that bypasses database user validation. The vulnerability allows full OS command execution, file system access, credential theft, and potential lateral movement within the network. The `projectPath` parameter is also susceptible to double-quote escape injection.

Cloud CLI (also known as Claude Code UI) is a desktop and mobile UI for Claude Code, Cursor CLI, Codex, and Gemini-CLI. Multiple Git-related API endpoints utilize `execAsync()` with string interpolation of user-controlled parameters – specifically `file`, `branch`, `message`, and `commit` – enabling authenticated attackers to execute arbitrary operating system commands. The application attempts to escape double quotes in some parameters, but this protection can be bypassed using shell metacharacters like command substitution ($(command) or `command`) and command chaining (; , &&, ||). The following API endpoints are affected: `/api/git/diff` (with the `file` parameter), `/api/git/status` (with the `file` parameter), `/api/git/commit` (with the `files` array and `message` parameter), `/api/git/checkout` (with the `branch` parameter), `/api/git/create-branch` (with the `branch` parameter), `/api/git/commits` (with the `commit` parameter), `/api/git/commit-diff` (with the `commit` parameter), `/api/git/file-with-diff` (with the `file` parameter), `/api/git/generate-commit-message` (with the `file` parameter), `/api/git/discard` (with the `file` parameter), and `/api/git/publish` (with the `branch` parameter). Successful exploitation could lead to remote code execution as the Node.js process user, potentially resulting in full server compromise and data exfiltration.

SiYuan is a personal knowledge management system. The `/api/network/forwardProxy` endpoint allows authenticated users to make arbitrary HTTP requests from the server. The endpoint accepts a user-controlled URL and makes HTTP requests to it, returning the full response body and headers. There is no URL validation to prevent requests to internal networks, localhost, or cloud metadata services. This could allow attackers to perform internal network reconnaissance, potentially steal cloud credentials, exfiltrate data, or bypass firewalls. The vulnerable code resides in `/kernel/api/network.go` (Lines 153-317) within the `forwardProxy` function, which only validates the URL format and not the destination. The `url` parameter within the JSON payload sent to the `/api/network/forwardProxy` endpoint is user-controlled.

Cloud CLI (also known as Claude Code UI) is a desktop and mobile UI for Claude Code, Cursor CLI, Codex, and Gemini-CLI. The `/api/user/git-config` endpoint constructs shell commands using user-provided `gitName` and `gitEmail` values, passing them to `child process.exec()`. Input is placed within double quotes, but only double quotes are escaped, leaving backticks (`), `$()` command substitution, and `` sequences vulnerable to interpretation within bash. This allows authenticated attackers to execute arbitrary operating system commands through the git configuration endpoint. The vulnerable code resides in `server/routes/user.js` (lines 58-59). Exploitation involves injecting malicious commands via the `gitName` parameter using command substitution, potentially leading to Remote Code Execution (RCE) as the Node.js process user. The server-wide git configuration can be modified, impacting all git operations. When combined with a bypass for JWT authentication, this can result in unauthenticated RCE.

Glances, a cross-platform system monitoring tool, contains a flaw in its TimescaleDB export module. The module builds SQL queries by concatenating strings with unverified system monitoring data. The `normalize()` function encloses string values in single quotes but does not escape any embedded single quotes, which allows for trivial SQL injection. Attackers can control data like process names, filesystem mount points, network interface names, and container names to exploit this issue. The vulnerability resides in the `normalize()` function within `glances/exports/glances timescaledb/ init .py` (lines 79-93) and the query construction section (lines 201-205). A proof of concept demonstrates that a normal user can create a process with a name containing a SQL injection payload, and then, when Glances is started with TimescaleDB export, a file is created in the /tmp directory, indicating successful SQL injection. Potential impacts include data destruction, data exfiltration, potential remote code execution, and privilege escalation. The vulnerability is due to the direct execution of concatenated SQL queries without using parameterized queries.

Budibase is a low code platform used for creating internal tools, workflows, and admin panels. A flaw exists in the server's `authorized()` middleware, which is designed to protect server-side API endpoints. By appending a webhook path pattern to the query string of any request, an attacker can bypass this middleware. The `isWebhookEndpoint()` function utilizes an unanchored regular expression that evaluates the entire URL, including query parameters, via `ctx.request.url`. When a match occurs, the `authorized()` middleware immediately calls `return next()`, effectively skipping all authentication, authorization, role checks, and CSRF protection. This allows a remote, unauthenticated attacker to access any server-side API endpoint. The vulnerable component is the `authorized()` middleware and the `isWebhookEndpoint()` function. API endpoints are susceptible to this bypass. The vulnerable parameter is the query string.

An unauthenticated information disclosure issue exists in the GET `/api/v1/status-page/:url` endpoint. The endpoint does not enforce authentication or verify if a status page is published before revealing complete status page details. This allows any unauthenticated user to access unpublished status pages and their internal data through direct API requests. The vulnerable parameter is `url`.

Glances is a cross-platform system monitoring tool. The '/api/4/config' REST API endpoint returns the entire Glances configuration file (glances.conf) without filtering sensitive values. This configuration file contains credentials for backend services, including database passwords, API tokens, JWT signing keys, and SSL key passwords. The vulnerability stems from the `as dict()` method in `config.py`, which iterates through all configuration sections and keys without applying any redaction. The API endpoint lacks authentication when started without a password. Exploitation involves retrieving the configuration file via a simple HTTP request, allowing attackers to extract sensitive information and potentially compromise the entire infrastructure.

The `/objects/playlistsFromUser.json.php` endpoint does not require authentication or authorization, allowing an unauthenticated attacker to enumerate user IDs and retrieve playlist information, including playlist names, video IDs, and playlist status, for any user on the platform. The endpoint accepts a `users id` parameter and directly queries the database without any authentication or authorization checks. This can lead to privacy violations, user enumeration, information gathering, and potential targeted attacks. The vulnerable file is `objects/playlistsFromUser.json.php`. The `getAllFromUser()` function is used to retrieve playlist data without verifying user access.

A Zip Slip vulnerability exists in the backup restore functionality, allowing arbitrary file overwrite via path traversal in uploaded ZIP archives. The application uses `zipfile.extractall()` without validating entry paths, enabling attackers to escape the extraction directory using '../' sequences. A malicious ZIP archive can contain entries crafted to overwrite sensitive files, such as the Flask secret key (`/secret.txt`), application settings (`changedetection.json`), and watch configurations (`url-watches.json` or `watch.json` within a UUID directory). The vulnerability is triggered by uploading a specially crafted ZIP archive via the backup restore functionality at the `/backups/restore` endpoint. The `restore backup()` function (lines 50-53) is vulnerable. Attackers can upload ZIP files containing malicious content, which is then written to sensitive locations on the system.

The changedetection.io application allows users to specify XPath expressions as content filters via the `include filters` field. These XPath expressions are processed using the elementpath library, which implements XPath 3.0/3.1 specifications. XPath 3.0 includes the `unparsed-text()` function, which can read arbitrary files from the filesystem. The application does not validate or sanitize XPath expressions to block dangerous functions, allowing an attacker to read any file accessible to the application process. The vulnerable code resides in the `html tools.py` file, specifically within the `xpath filter()` function (lines 187-220). The application's validation in `forms.py` only checks for syntactical validity of the XPath expression and does not prevent the use of dangerous functions like `unparsed-text()`. An attacker can exploit this by setting the `include filters` field to an XPath expression that utilizes `unparsed-text()` to read arbitrary files, such as `/etc/passwd`.