Pig-Tail

The unauthenticated POST '/ nuxt content/:collection/query' endpoint accepts an attacker-controlled `sql` field in 'src/runtime/api/query.post.ts' that permits expensive SQLite expressions. While some releases use the `assertSafeQuery()` function in 'src/runtime/internal/security.ts' to reject certain SQL keywords in WHERE clauses, it still allows function calls such as `randomblob()`, `zeroblob()`, `hex()`, and `length()`. These queries reach the synchronous better-sqlite3 sink in 'src/runtime/internal/database.server.ts', enabling a single remote request to consume significant CPU and memory, which blocks the Node.js event loop and halts all concurrent request handling. Fully static prerendered deployments that do not expose the server endpoint are not affected.

In the file `library/classes/Controller.class.php`, the `checkControllerAcl()` function fails to enforce permissions for controllers missing from the `CONTROLLER ACL MAP`. This fail-open dispatcher allows a low-privilege authenticated user to bypass access control lists (ACL) and invoke administrative controllers. Specifically, an attacker can use `C X12Partner::edit action process()` to create or modify insurance-routing hosts and credentials, or use `C PatientFinder::find action process()` to enumerate patient identifiers, names, and dates of birth. This issue also exposes other administrative controllers intended to be restricted via Practice Settings routes.

The multisite administration page located at the 'admin.php' endpoint is enabled without an authentication check. This allows an unauthenticated network actor to read database configurations from `sqlconf.php` and connect to configured site databases. Consequently, an attacker can obtain site identifiers, database names, site names, exact software versions and patch levels, pending upgrade status, and direct links to logins and patient portals.

An issue exists where the application constructs an object key using the authenticated user identifier and a client-controlled `fileName` without properly rejecting path separators or parent-directory traversal. In the R2 backend, this key is placed into a Request URL before signing; URL normalization then collapses parent-directory components, allowing a presigned PUT request to escape the caller's namespace. An authenticated attacker with knowledge of a target user identifier and book hash can overwrite or poison another user's stored book object and corrupt the associated `file key` metadata.

An issue exists where the application grants paid plans to authenticated users without properly verifying the session ownership. Specifically, the endpoint "/api/stripe/check" accepts a client-controlled `sessionId` to retrieve a Stripe Checkout Session but fails to verify the `session.metadata.userId`. Consequently, the `createOrUpdateSubscription()` function updates the subscription plan for the authenticated caller instead of the actual session owner. This allows an authenticated free user to reuse a valid paid Checkout Session identifier to upgrade multiple accounts without additional payment.

The unauthenticated '/api/opds/proxy' endpoint allows a remote attacker to perform Server-Side Request Forgery (SSRF), a technique where the server is tricked into making requests to an unintended location. The application fetches attacker-controlled URLs without restricting schemes or blocking private, loopback, link-local, or metadata hosts, and fails to revalidate destinations during automatic redirects. Additionally, the endpoint accepts caller-controlled outbound headers and `Authorization` values, reflecting the upstream status and response body. In Node, Docker, or self-hosted deployments with internal-network access, this can be used to retrieve cloud metadata or internal-service responses. While Cloudflare Workers deployments restrict access to link-local and private destinations, the public fetch-and-reflect behavior persists.

In desktop Tauri builds, the `download file` and `upload file` commands within the `apps/readest-app/src-tauri/src/transfer file.rs` file fail to validate the `file path` variable. The application does not check the Tauri filesystem scope, reject absolute paths, or block parent-directory traversal. Because these commands are registered in the global invoke handler for the main, updater, and reader windows, JavaScript executing in the privileged application origin can read or write files to any path accessible by the process. This could allow an attacker to overwrite trusted startup files or expose sensitive data such as keys, tokens, and application secrets. Exploitation requires JavaScript execution within the privileged origin, which could occur via application XSS or a compromised renderer.

The Variants Livewire component in `packages/admin/src/Livewire/Components/Products/Form/Variants.php` lacks server-side authorization for `DeleteAction` and `DeleteBulkAction`. An authenticated staff user with `edit products` permissions can access the endpoint `/shopper/products/{id}/edit` to obtain the signed component state. Subsequently, the `callTableAction` and `callTableBulkAction` paths allow the permanent deletion of single or multiple product variants without verifying the `delete product variants` permission. This can lead to the destruction of the sellable catalogue and disruption of storefront product pages, cart, and checkout processes.

An issue exists in the cluster registration flow where the cluster identity claimed by a registration request is accepted without being bound to the registration token used for the request. This allows a registration request to be associated with a managed cluster that was originally registered using a different registration token.

Crass incorrectly treats a closing parenthesis after an escaped backslash as escaped when consuming the remnants of a bad URL. This causes declarations, style rules, or at-rules to remain inside a bad URL token, which browsers then interpret as live CSS. A sanitizer using Crass to parse untrusted CSS and reserialize it without rejecting the bad URL may allow CSS used for UI redress, external resource loading, or CSS-based data exfiltration. This issue does not enable script execution in modern browsers.

An authorization bypass allows authenticated users to access gateway tunnel information belonging to other realms. By requesting the `getGatewayActiveTunnelInfos` endpoint using their own realm and a victim gateway ID, attackers can disclose internal target hosts, ports, and routing data.

Insufficient realm or gateway-descendant authorization on inbound edge gateway events allows an attacker controlling a registered gateway to break tenant isolation. The system maps event asset IDs using the reversible `GatewayConnector.mapAssetId` transform. By crafting pre-image IDs within `AttributeEvent` or `DELETE AssetEvent` messages, an attacker can overwrite attributes of or delete assets across any realm.

The Git webhook receiver (the gitjob webhook service) fails to verify incoming requests when a webhook secret is not configured. This allows a remote caller with network access to the service, even without Kubernetes credentials, to modify the `spec.pollingInterval` field of a matching GitRepo resource across any namespace, enabling unauthorized configuration changes.

A cross-tenant authorization issue exists during agent-initiated cluster registration. Cluster labels provided by the registering agent, including those in the reserved `management.cattle.io/` namespace (such as the cluster display name label), are applied to the resulting upstream Cluster object. Since Fleet uses these labels to resolve GitRepo and Bundle targets, a user registering a cluster into a shared Fleet workspace namespace could manipulate labels to satisfy targeting rules intended for a different cluster.

A user with the ability to provide bundle content to a repository referenced by a GitRepo resource, such as through Git push access or permissions to create or modify a GitRepo, can force the system to read files from the filesystem of the bundle-processing environment. These files are then included in the generated Bundle resource, potentially exposing configuration data or credentials that the user is not authorized to access via Kubernetes RBAC (Role-Based Access Control), including Helm registry credentials used when per-path Helm credentials are configured.

GitPython fails to include the `--separate-git-dir` flag in its `unsafe git clone options`. This allows an attacker to provide a `separate git dir` parameter to the `Repo.clone from()` or `Repo.clone()` functions, redirecting repository metadata to an arbitrary filesystem path. This behavior can lead to the creation of unauthorized directories and the potential execution of git hooks, which are scripts that run automatically when certain events occur in a git repository.

An issue exists when parsing `.gitmodules` files where the software fails to disable `merge includes`. This allows an attacker to disclose the content of local files by using `[include]` directives to point to arbitrary file paths. When the `repo.submodules` property is accessed, the `GitConfigParser` function raises a `MissingSectionHeaderError` that includes the first line of the targeted file within the exception message.

GitPython fails to safely re-serialize multi-line git-config values during write operations. This allows attackers to craft configuration files containing embedded newlines that can be corrupted into injected directives, such as `core.hooksPath`. When any unrelated configuration write occurs, these dormant quoted values become active git directives, which can lead to arbitrary code execution through hook invocation.

The ForwardAuth middleware in this HTTP reverse proxy and load balancer incorrectly derives the `X-Forwarded-Port` header sent to the authentication service from the original incoming request rather than the sanitized forwarded request, even when `trustForwardHeader` is set to `false`. This allows an unauthenticated remote attacker to inject an `X-Forwarded-Proto: https` header via a plain HTTP connection, leading the system to forward `X-Forwarded-Port: 443` to the authentication service and bypass port-based authorization checks.

Internal developer endpoints '/webpack-dev-server/open-editor' and '/webpack-dev-server/invalidate' perform state-changing actions on GET requests without verifying the request origin. This allows any website visited by a developer to trigger these endpoints cross-origin. An attacker can open arbitrary local files in the developer's editor, including those outside the project root. Additionally, repeated requests can spawn multiple editor processes and force recompilations, leading to system performance degradation.