Riodrwn

An issue exists where the `assemble-chunks` endpoint retrieves an upload session using only its session ID, failing to scope the lookup to the authenticated profile as the `upload-chunk` endpoint does. An authenticated user who obtains another user's live, completed upload-session UUID can assemble the victim's chunks into their own file, team font, or project import. This leads to the disclosure of the uploaded bytes and the deletion of the victim's pending session.

Insufficient authorization on REST API user write endpoints allows a user with an update-scoped OAuth token to modify sensitive account details of other non-superuser accounts. By exploiting the lack of per-field `edit user properties` permission enforcement, an attacker with permission to edit only one non-sensitive field can change the password, username, email, and attributes of another user, leading to full account takeover. The affected endpoints are 'PUT /ccm/api/1.0/users/{uID}' and 'POST /ccm/api/1.0/users/{uID}/change password'.

Cross-Site Request Forgery (CSRF) exists in the dashboard SEO Excluded Words page. The `reset()` controller action clears the administrator-configured reserved-word list `concrete.seo.exclude words` without validating the anti-CSRF token or restricting requests to the POST method. A remote attacker could lure an authenticated user with SEO access to a crafted page to revert the reserved-word list to its default. This action silently alters future URL-slug generation for pages, files, topics, and other objects created through the Text urlify service, effectively undoing the site's configured SEO slug policy.

The conversation attachment uploaded endpoint imports files into the file manager before evaluating the `Add Message Attachments` permission. Because this permission is only checked after the file has been stored, a user without the required permission or an unauthenticated visitor in a guest-posting configuration can import approved file types into the file manager.

The dashboard group type controller fails to validate a CSRF (Cross-Site Request Forgery) token during its delete action. This allows a remote unauthenticated attacker to trick an authenticated user who possesses group type management permissions into deleting a custom group type.

The Area API's 'block-create' endpoint fails to invoke the `validate()` method of the block type controller for submitted data. For blocks that reference files, such as `hero image` and `gallery`, this method is responsible for authorizing the referenced file against the user's file-manager visibility. Consequently, an authenticated user with the `block-add` scope can store and render a reference to a file that should be rejected by the file-manager authorization policy. This leads to the disclosure of the file's URL and preview to the editor and page visitors. In public file storage configurations, the URL and thumbnail are exposed directly, while in private storage, disclosure is limited by the permission-checked download URL.

The Express REST API list endpoint fails to perform per-entry view permission checks. An attacker using an OAuth token with read scope for an Express entity can enumerate entries that the user context is not authorized to view. This leads to the disclosure of the public identifier, URL, label, dates, and any attribute or associated-entry data requested through the `includes` parameter.

The RSS Displayer block fails to perform HTML escaping on remote feed item titles, leading to stored cross-site scripting (XSS). An attacker who can control a title within a syndicated feed can execute arbitrary scripts in the site origin for any visitor to the affected page, including administrators, without requiring an account on the site.

Stored Cross-Site Scripting (XSS) exists in the Board Custom Slot dialog. The 'custom slot save template' endpoint validates requests only against the target board instance using the `canEditBoardContents()` function and persists the `selectedTemplateOption[collection]` variable verbatim. Because the server does not verify that each item belongs to the authorized board's data pool, a user with board editing permissions can store a forged summary object containing a JavaScript payload in the description field. The default summary template renders this field without output encoding, allowing the payload to execute in the browsers of users viewing the board slot, including anonymous visitors and dashboard users. This may lead to session takeover, action takeover, or privilege escalation to an administrator.

Cross-Site Request Forgery (CSRF) exists in the Move Multiple Groups feature. The endpoint 'dashboard/users/groups/bulkupdate/confirm()' allows moving selected group tree nodes without validating an action token. This allows a state-changing group move to be processed for an authenticated user who did not initiate the request. Since relocating a group under a new parent causes members to inherit the parent's permissions, a forged move can alter effective authorization.

An authorization bypass known as Insecure Direct Object Reference (IDOR) exists because the frontend calendar lightbox endpoint '/ccm/calendar/view event/{bID}/{occurrence id}' fails to verify if the requester has permission to view the calendar associated with the requested event. The controller retrieves the event occurrence using a sequential identifier provided by the user without confirming its ownership relative to the referenced block. Consequently, an unauthenticated visitor can provide an arbitrary `occurrence id` to disclose event metadata, including titles, dates, descriptions, page links, and configured event attributes from restricted calendars.

An authentication bypass exists in the multi-agent teams system where the ` create agents app()` function fails to authenticate requests to the 'POST /agents' and 'POST /agents/{agent name}' endpoints. Consequently, requests with missing or incorrect bearer tokens and `X-API-Key` values can still trigger agent execution.

PraisonAI contains path traversal flaws in its `praisonai.code` tool wrappers, which are intended to treat the `workspace` setting as a security boundary. The boundary is enforced inconsistently and unsoundly across several tools: 1. The `is path within directory()` function uses `os.path.abspath()` instead of `os.path.realpath()`. This allows a symlink located inside the workspace that points to a target outside the workspace to bypass security checks, enabling the `read file`, `write file`, `apply diff`, and `search replace` tools to access external files. 2. The `list files()` function fails to call the containment helper entirely, allowing absolute paths or `../` sequences to escape the workspace. 3. The `execute command()` and `code execute command()` functions do not validate the `cwd` (current working directory) parameter, allowing commands to be executed from directories outside the configured workspace. An attacker capable of influencing an agent—via untrusted prompts or indirect prompt injection—can read, overwrite, list, and execute files and binaries outside the workspace, limited only by the filesystem permissions of the process user.

The Jobs API in PraisonAI lacks authentication middleware, router-level dependencies, and per-route authorization checks. This allows any caller who can reach the jobs server to submit agent jobs using the operator's configured LLM credentials, list all jobs in the shared store, read results of other jobs, cancel running jobs, and delete terminal jobs. The issue occurs because the `create app()` function in `server.py` mounts the jobs router without any authentication mechanism.

The software fails to revalidate share access when restoring cached navigator state from a `context hint` UUID. This allows attackers who previously held valid share access to replay the cached hint to generate signed file URLs for up to 300 seconds after the share has been deleted, expired, or reached the limit of remaining downloads.

An issue exists in the `serendipity url allowed()` filter that fails to block hex-encoded IPv4 addresses, IPv6 literals, and link-local ranges. Authenticated users with `adminImagesAdd` permission can bypass this filter using alternate address formats to perform a server-side request forgery, allowing them to request internal services and retrieve response bodies through the public uploads directory.

The AdminerFileUpload plugin allows authenticated users to upload PHP files due to a permissive default extension allowlist. Attackers can upload PHP webshells to columns ending in ` path` and execute arbitrary code as the web-server user when `uploadPath` is web-served.

An issue exists in the ScopedFs component where the system validates the nearest existing ancestor of a dangling symlink as being within scope and subsequently follows that symlink during file creation. This allows an authenticated user possessing Create and Modify permissions to create files outside of their assigned scope.

e107 is a content management system (CMS) that contains a command injection issue in the ImageMagick resize destination path. Within the `resize image()` function, the source path is properly escaped, but the destination path is inserted into raw double quotes in the convert command. In the submit-news upload flow, the destination filename incorporates the first six characters of the user-controlled news title input. Since the title filter removes literal spaces but not tab characters, shell expansions such as $(...) and backticks can persist in the quoted destination argument, allowing `/bin/sh -c` to evaluate attacker-controlled input. Exploitation requires the following non-default settings to be enabled: - `resize method` set to ImageMagick - `subnews attach` set to 1 - `upload enabled` set to 1 - `subnews resize` as a numeric value between 30 and 5000 - The attacker must be a non-admin in classes permitted by both `subnews class` and `upload class`.

The issue allows authenticated users, such as Subscribers, to perform Stored Cross-Site Scripting attacks due to the lack of sanitization and escaping of reviews.