Santoshkumarpuppala

OpenPanel through commit cd24bb8 contains an SQL injection vulnerability in the analytics filter builder that fails to validate profile.* filter column identifiers before interpolating them into ClickHouse WHERE clauses. An authenticated attacker with project-scoped read or root export credentials can inject arbitrary ClickHouse SQL to bypass project isolation and read other organizations' analytics data and profile PII via blind boolean oracle techniques.

**Name of the Vulnerable Software and Affected Versions** libreoffice-convert versions prior to 1.8.2 **Description** The `index.js` file fails to normalize the `options.fileName` variable using `path.basename()` when constructing a filesystem path via `path.join(tempDir.name, fileName)`. This allows a caller to provide a filename containing path traversal sequences like `../`, enabling the writing of a document buffer to arbitrary paths writable by the process, such as SSH `authorized keys` files, cron configurations, or web roots. **Recommendations** Update to version 1.8.2. As a temporary workaround, ensure the `options.fileName` variable is not user-supplied or apply `path.basename()` to the filename before passing it to the module.