Sondt99

The `web.NewHandler` static file server in `web/handler.go` fails to verify that the result of joining the URL-decoded `r.URL.Path` with `Config.AppDir` remains within the configured application directory. An unauthenticated remote attacker can use URL-encoded dot segments, such as `%2e%2e`, to bypass the traversal redirect performed by Go's ServeMux. This allows the attacker to access and disclose files outside of `Config.AppDir` that are readable by the server process, even when Dev mode is disabled.

A cross-site request forgery issue exists in the pCloud backend's localhost OAuth callback. The system disables the state check and trusts the `hostname` parameter. This allows malicious web pages to send a stateless request to port 53682 during authorization, enabling the planting of attacker tokens and API hosts, which can cause subsequent data transfers to be routed to the attacker.

An authentication bypass exists in the serve webdav functionality. Unauthenticated attackers can bypass security checks by sending OPTIONS requests, allowing them to probe arbitrary paths. By comparing the values in the Allow header, attackers can determine if specific files or collections exist, which facilitates namespace enumeration.

Ghost, a Node.js content management system, allows staff users, including those with Contributor roles, to host arbitrary HTML on the site domain. This occurs when creating a bookmark card, as the system may store non-image files fetched from external websites as bookmark icons or thumbnails. This behavior could lead to the compromise of administrative sessions of other staff users.

A cross-site scripting issue exists in the Bazar valeur action. Page editors can inject scripts by rendering unescaped HTML fetched from a remote URL. An attacker can direct the 'tools/bazar/actions/valeur.php' endpoint to a controlled server that returns BAZ fiche titre markup containing an `img` `onerror` handler, which executes the script in the browser of any user viewing the page.

An improper locking issue exists where a non-deferred mutex unlock leaks during a nil-map panic path. An authenticated non-admin member can exploit this by issuing four notification API calls to permanently deadlock the alerting subsystem, subsequently exhausting memory through blocking requests.

A lock-order inversion exists within the `UpdateGroup` and `DeleteGroup` functions. This flaw allows authenticated users without administrative privileges to cause a deadlock in the alerting subsystem. By concurrently calling the 'notification-group' and 'batch-delete' endpoints using oversized `id` lists, an attacker can create an ABBA cycle, which is a specific type of deadlock where two or more threads are blocked waiting for each other to release locks. This results in the permanent failure of alert delivery until the system is restarted.

A stored cross-site scripting issue exists that allows staff users, such as Contributors, to host arbitrary HTML. This is achieved by abusing the bookmark card image fetching mechanism, where attackers can create bookmark cards that store non-image files from external websites as icons or thumbnails to compromise the admin sessions of other staff users.

A missing authorization issue exists in the attachment download handler. This allows unauthenticated attackers to bypass page read Access Control Lists (ACLs), which are sets of rules that define which users or systems are granted access to specific objects. By requesting the download handler with a known page tag and the `file` parameter, an attacker can retrieve confidential attachments from pages that are restricted from being read.

A server-side request forgery (SSRF) issue exists in the Bazar valeur action. Page editors can force the server to fetch arbitrary URLs by manipulating the `url` parameter. By embedding this action with a `champ` parameter in wiki markup, attackers can access loopback or internal services, partially read responses rendered on the page, and inject unescaped remote HTML to execute scripts in the browsers of users viewing the page.

An authorization bypass exists in the `isAuthorized()` function of the `ApiService` when public API mode is enabled. This allows unauthenticated attackers to access administrative API routes. Specifically, attackers can interact with the 'api/ci/update config' and 'api/archives' endpoints to overwrite system configurations or list, download, and delete backup archives.

A stored cross-site scripting issue exists in the `formatters/wakka.php` file. Users with permissions to edit pages or post comments can inject event handlers by inserting quotes into markdown image URLs. This allows an attacker to craft a markdown image where the `src` attribute is bypassed to include an `onerror` handler, resulting in the execution of arbitrary JavaScript in the browsers of users who view the page, including those with administrator privileges.

Authenticated non-administrator users can create malformed alert rules due to a lack of validation for alert rule types and duration bounds. By submitting a crafted alert rule via the 'POST /api/v1/alert-rule' endpoint, an attacker can trigger unrecovered panics in the alert evaluator goroutine (a lightweight thread managed by the Go runtime). This results in a crash of the dashboard process; because the rule is persisted, the process will crash repeatedly upon restart, disabling all monitoring and control plane functionality.

The device token deduplication logic for installation records fails to validate the type of client-supplied installation fields before using them to construct database queries. An unauthenticated remote attacker with knowledge of the public application ID can submit non-string values in these fields to inject query operators. This causes the deduplication cleanup process, which operates with elevated privileges before class-level permissions are checked, to delete all device registrations in the application or a specific subset chosen by the attacker. This action results in the permanent loss of registrations on the server, preventing the delivery of push notifications until all clients re-register. Any deployment using push notifications that exposes the REST API to clients is affected in its default configuration.

Requests to the HTTP MCP endpoint without a per-user identity can reach tool handlers that utilize globally configured Jira or Confluence credentials. This allows a network caller to perform operations using the permissions of the operator account if the deployment lacks an independent authentication boundary. The processing flow involves `streamable-http`, `UserTokenMiddleware`, ` get fetcher`, and global credentials.

OAuthConfig writes a plaintext fallback file containing `access token` and `refresh token` within the user's `.mcp-atlassian` directory. This file is created using process-default permissions rather than restrictive ones. On systems with a permissive umask, local users or processes in the same group can read these persisted tokens and reuse them to gain unauthorized access to Atlassian products. The issue occurs during the execution of the `OAuthConfig. save tokens()` function, which unconditionally maintains a plaintext copy of the tokens in `~/.mcp-atlassian/oauth-<client id>.json` for backwards compatibility, even when keyring storage is successful.

Jira and Confluence attachment upload tools accept arbitrary local filesystem paths and send the selected bytes to Atlassian. In HTTP or multi-user deployments, a caller can cross the client-to-server filesystem boundary to disclose configuration, credentials, mounted secrets, or other files readable by the MCP process. This server-side arbitrary file read and exfiltration occurs because the implementation converts relative paths to absolute paths and opens them without validating if the path is safe or restricted to an allowed directory. The issue affects the following components: - **API Endpoints:** The attachment upload tools for Jira and Confluence. - **Vulnerable Parameters:** The `file path` parameter and the `attachments` field (which accepts JSON or CSV local paths). - **Function Names:** `jira upload attachment()`, `confluence upload attachment()`, and `upload attachment()`.

Authenticated users can read lock metadata from repositories they are not authorized to access because Git LFS (Large File Storage) lock queries are not scoped by repository. An attacker with write access to any repository can globally enumerate lock IDs to recover usernames, lock timestamps, and locked file paths from private repositories.

The software fails to fully enforce the `allowAsync: false` option within VM and NodeVM. Although `localPromise.prototype.then` is replaced to prevent asynchronous operations, the sandbox's Promise static methods—specifically `Promise.resolve`, `Promise.all`, `Promise.race`, `Promise.any`, and `Promise.allSettled`—still accept attacker-supplied thenables. This occurs because native promise resolution executes a `PromiseResolveThenableJob` and invokes the `then` method of the sandboxed code in a microtask, bypassing the patched handler. Consequently, a sandboxed script can schedule tasks that execute after `VM.run()` or `NodeVM.run()` has returned and beyond the configured timeout, allowing execution to continue after the host assumes it has finished.

Insufficient validation of file paths in the project config instructions field allows for the reading of arbitrary files on a system. An attacker can use a malicious `.codewhale/config.toml` file within a cloned repository to specify paths outside the workspace. These files are then read and injected into the AI system prompt, which can be used for data exfiltration.