Shubham Raj

**Name of the Vulnerable Software and Affected Versions** Eclipse Theia versions prior to 1.73.2 **Description** The `@theia/filesystem` backend binds the 'POST /file-upload' endpoint in every filesystem-enabled deployment. The handler processes an absolute path provided by an attacker via the multipart `uri` field and executes `fs.move(tmp, target, { overwrite: true })` without authentication or workspace confinement. In browser-based deployments, the connection token is only enforced during WebSocket upgrades, while the HTTP middleware in `@theia/core` fails to reject tokenless HTTP requests. Since `multipart/form-data` is a CORS-safelisted request type, a cross-origin web page can trigger an unauthenticated arbitrary file write to any absolute path accessible to the backend process. This can lead to remote code execution, such as by overwriting the `~/.bashrc` file. **Recommendations** Update to a version newer than 1.73.1.

**Name of the Vulnerable Software and Affected Versions** Apache Airflow versions prior to 3.3.0 **Description** The Bulk Variables API fails to pass the variable's key to the redactor. This prevents the `should hide value for key` function from identifying secret-suffixed key names, such as `* password`, `* token`, or `* secret`. Consequently, an authenticated user with bulk Variable read permissions can retrieve plaintext values from JSON-decodable variables that should have been redacted. **Recommendations** Upgrade to version 3.3.0 or later.

**Name of the Vulnerable Software and Affected Versions** apache-airflow-providers-ftp versions prior to 3.15.1 **Description** The `FTPSHook.get conn()` function in the Apache Airflow FTP provider creates an `ftplib.FTP TLS` connection without calling `prot p()`. This results in the data channel being transmitted in cleartext, even though the control channel is TLS-protected. Consequently, deployments utilizing `FTPSHook` or `FTPSFileTransmitOperator` to transfer files over FTPS expose file contents and credentials-in-transit to network attackers capable of observing the data connection. **Recommendations** Update apache-airflow-providers-ftp to version 3.15.1 or later.

**Name of the Vulnerable Software and Affected Versions** Apache Airflow versions 3.1.0 through 3.1.7 **Description** The `/ui/dependencies` endpoint in Apache Airflow returns the complete DAG dependency graph without filtering by authorized DAG IDs. This allows an authenticated user with only DAG Dependencies permission to enumerate DAGs they are not authorized to view. **Recommendations** Upgrade to Apache Airflow version 3.1.8 or later.

**Name of the Vulnerable Software and Affected Versions** Apache Airflow versions 3.1.0 through 3.1.6 **Description** An authorization flaw exists in Apache Airflow that could allow an authenticated user with limited task permissions to view task logs without proper authorization. The issue affects systems where users have custom permissions restricting access to task logs, but still permit task access. **Recommendations** Upgrade to Apache Airflow version 3.1.7 or later.

Name of the Vulnerable Software and Affected Versions: Apache Airflow versions prior to 2.10.3 Description: The issue allows authenticated users with audit log access to see sensitive values in audit logs that they should not see. This occurs when sensitive variables are set via the Airflow CLI, resulting in the values being stored unencrypted in the Airflow database. The risk is limited to users with audit log access. Recommendations: For Apache Airflow versions prior to 2.10.3, upgrade to Airflow 2.10.3 or a later version to address this issue. Additionally, users who previously used the CLI to set secret variables should manually delete entries with those variables from the log table.