https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T22:48:35.192757+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-104201 EUVD-2026-104201 2026-10-06T22:48:35.265216+00:00 EUVD-2026-104201 https://cve.radiocsirt.org/vuln/fkie_cve-2024-24765 fkie_cve-2024-24765 2026-10-06T22:48:35.265262+00:00

CasaOS-UserService provides user management functionalities to CasaOS. Prior to version 0.4.7, path filtering of the URL for user avatar image files was not strict, making it possible to get any file on the system. This could allow an unauthorized actor to access, for example, the CasaOS user database, and possibly obtain system root privileges. Version 0.4.7 fixes this issue.

 https://cve.radiocsirt.org/vuln/ghsa-h5gf-cmm8-cg7c GHSA-h5gf-cmm8-cg7c — CasaOS-UserService allows unauthorized access to any file 2026-10-06T22:48:35.265300+00:00

Affected: Go: github.com/IceWhaleTech/CasaOS-UserService

### Summary

http://demo.casaos.io/v1/users/image?path=/var/lib/casaos/1/avatar.png

Originally it was to get the url of the user's avatar, but the path filtering was not strict, making it possible to get any file on the system.

### Details

Construct paths to get any file.

Such as the CasaOS user database, and furthermore can obtain system root privileges.

### PoC

http://demo.casaos.io/v1/users/image?path=/var/lib/casaos/conf/../db/user.db

### Impact

v0.4.6 all previous versions

 https://cve.radiocsirt.org/vuln/gsd-2024-24765 gsd-2024-24765 2026-10-06T22:48:35.265337+00:00 gsd-2024-24765