diff --git a/documentation/security-watch/state.json b/documentation/security-watch/state.json index 5b705077..3b1027b3 100644 --- a/documentation/security-watch/state.json +++ b/documentation/security-watch/state.json @@ -160,7 +160,7 @@ }, "dooplex:flomp/wanderer-db|release:open-wanderer/wanderer@v0.21.2": { "first": "2026-10-26", - "last_mailed": "2026-10-26", + "last_mailed": "2026-11-02", "program": "flomp/wanderer-db v0.20.0 (wanderer)", "summary": "( GHSA-fprh-3pp9-68m9 , thanks @zer0d4y5 )" }, @@ -196,7 +196,7 @@ }, "dooplex:flomp/wanderer-web|release:open-wanderer/wanderer@v0.21.2": { "first": "2026-10-26", - "last_mailed": "2026-10-26", + "last_mailed": "2026-11-02", "program": "flomp/wanderer-web v0.20.0 (wanderer)", "summary": "( GHSA-fprh-3pp9-68m9 , thanks @zer0d4y5 )" }, @@ -405,12 +405,30 @@ "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Fork pull requests can read reusable workflow files from another private repository (missed sibling of GHSA-fj8v-hjwv-qm88)" }, + "dooplex:gitea/gitea|GHSA-32h8-5xqg-h466": { + "first": "2026-11-02", + "last_mailed": "2026-11-02", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Actions: fork workflow gets secrets and write token via review commit_id" + }, "dooplex:gitea/gitea|GHSA-36q5-5423-vgx2": { "first": "2026-10-28", "last_mailed": "2026-10-28", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Unbounded Alpine .PKGINFO parse amplifies a small .apk upload into process memory" }, + "dooplex:gitea/gitea|GHSA-37xv-m4w7-j2fh": { + "first": "2026-11-02", + "last_mailed": "2026-11-02", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Public-only tokens bypass private-resource restrictions on the admin API" + }, + "dooplex:gitea/gitea|GHSA-3fv3-hhmm-4x2q": { + "first": "2026-11-02", + "last_mailed": "2026-11-02", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "GET /{user}.rss / .atom leak private activity to a scope-confined API token (2nd incomplete-fix follow-up of GHSA-6cqf-375w-639g, user feed never got the scope-" + }, "dooplex:gitea/gitea|GHSA-3pww-vcvm-3gmj": { "first": "2026-10-28", "last_mailed": "2026-10-28", @@ -500,6 +518,12 @@ "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Local File Inclusion via file:// URI in Migration Restore" }, + "dooplex:gitea/gitea|GHSA-5j4v-rwqr-vpq7": { + "first": "2026-11-02", + "last_mailed": "2026-11-02", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Gitea web profile and feed routes bypass public-only token scope for limited-visibility users" + }, "dooplex:gitea/gitea|GHSA-5w72-2mqm-qh46": { "first": "2026-10-28", "last_mailed": "2026-10-28", @@ -556,6 +580,12 @@ "silent": "first read after the seed", "summary": "Migration / pull-mirror SSRF, egress allow-list bypass via multi-answer DNS - 3 findings" }, + "dooplex:gitea/gitea|GHSA-6h2f-c8jm-84hc": { + "first": "2026-11-02", + "last_mailed": "2026-11-02", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Write collaborators can replace and destroy releases, milestones and labels on archived repositories (archived write-protection bypass)" + }, "dooplex:gitea/gitea|GHSA-6hm7-3pwj-22rm": { "first": "2026-10-28", "last_mailed": "2026-10-28", @@ -614,6 +644,12 @@ "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories" }, + "dooplex:gitea/gitea|GHSA-8g99-g36h-5p2w": { + "first": "2026-11-02", + "last_mailed": "2026-11-02", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Public-only package tokens can access private OCI blobs" + }, "dooplex:gitea/gitea|GHSA-8hhh-mqpg-jpxc": { "first": "2026-10-27", "last_mailed": "2026-10-27", @@ -628,6 +664,12 @@ "silent": "first read after the seed", "summary": "Draft releases include attachment metadata from other repositories" }, + "dooplex:gitea/gitea|GHSA-8p3x-w464-4g6v": { + "first": "2026-11-02", + "last_mailed": "2026-11-02", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Account Takeover via OAuth2 Auto-Linking with Attacker-Controlled Username" + }, "dooplex:gitea/gitea|GHSA-8p9h-49rc-qgxj": { "first": "2026-10-28", "last_mailed": "2026-10-28", @@ -641,6 +683,12 @@ "silent": "first read after the seed", "summary": "Built-in SSH server auth bypass via case-insensitive LIKE key lookup" }, + "dooplex:gitea/gitea|GHSA-8r36-6j2c-3gmv": { + "first": "2026-11-02", + "last_mailed": "2026-11-02", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Gitea Actions task tokens authenticate to the REST API with no token scope, enabling instance-wide private repository enumeration via GET /api/v1/user/repos" + }, "dooplex:gitea/gitea|GHSA-8r3w-5682-jrqf": { "first": "2026-10-28", "last_mailed": "2026-10-28", @@ -711,6 +759,12 @@ "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads" }, + "dooplex:gitea/gitea|GHSA-9v6p-xpcp-7488": { + "first": "2026-11-02", + "last_mailed": "2026-11-02", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Stored XSS on the Gitea origin through the v3 artifact Content-Encoding header" + }, "dooplex:gitea/gitea|GHSA-c3cr-qq9g-666c": { "first": "2026-10-27", "last_mailed": "2026-10-27", @@ -718,6 +772,12 @@ "silent": "first read after the seed", "summary": "Unauthenticated nil-pointer panic on /{username}/-/repositories for individual users" }, + "dooplex:gitea/gitea|GHSA-c45m-jm46-mwxg": { + "first": "2026-11-02", + "last_mailed": "2026-11-02", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Public project boards disclose private pull request titles and repository names" + }, "dooplex:gitea/gitea|GHSA-cp3q-vrj2-ghhh": { "first": "2026-10-28", "last_mailed": "2026-10-28", @@ -881,6 +941,12 @@ "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "REST API exposes organization membership of private organizations to public" }, + "dooplex:gitea/gitea|GHSA-jr76-w9m3-3p68": { + "first": "2026-11-02", + "last_mailed": "2026-11-02", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Contribution heatmap discloses private-repository contribution counts to public-only tokens (GetUserHeatmapData never reads ctx.PublicOnly while activity feeds " + }, "dooplex:gitea/gitea|GHSA-m6qc-j894-7h9r": { "first": "2026-10-28", "last_mailed": "2026-10-28", @@ -912,6 +978,12 @@ "silent": "first read after the seed", "summary": "Cross-Session OpenID Credential Linking Enables Account Takeover" }, + "dooplex:gitea/gitea|GHSA-mf6p-vqpw-3r7x": { + "first": "2026-11-02", + "last_mailed": "2026-11-02", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Actions token can spoof instance-signed commits by adding a GPG key" + }, "dooplex:gitea/gitea|GHSA-mg4f-x9v4-6h2p": { "first": "2026-10-28", "last_mailed": "2026-10-28", @@ -945,6 +1017,12 @@ "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Private Repository Existence Disclosure via go-get Meta Endpoint" }, + "dooplex:gitea/gitea|GHSA-p86q-78gw-8f3f": { + "first": "2026-11-02", + "last_mailed": "2026-11-02", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Cross-repository issue dependency and timeline read path serializes private issue title/body and attachments without the source repository access check (LoadDep" + }, "dooplex:gitea/gitea|GHSA-pgqf-926r-548m": { "first": "2026-10-28", "last_mailed": "2026-10-28", @@ -988,12 +1066,30 @@ "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "User-scoped tokens can mint unscoped HTTP signature API credentials" }, + "dooplex:gitea/gitea|GHSA-q9gm-9c7q-c5hq": { + "first": "2026-11-02", + "last_mailed": "2026-11-02", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "OIDC userinfo: the public-only token scope is not enforced when the token arrives as a query parameter (residual of CVE-2026-55982)" + }, "dooplex:gitea/gitea|GHSA-q9pg-jj6x-j9p6": { "first": "2026-10-28", "last_mailed": "2026-10-28", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive I" }, + "dooplex:gitea/gitea|GHSA-qcgm-ggp8-22qc": { + "first": "2026-11-02", + "last_mailed": "2026-11-02", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Public-only PAT scope bypass via Actions runner registration leaks private repository secrets" + }, + "dooplex:gitea/gitea|GHSA-r6mh-qg79-rqj2": { + "first": "2026-11-02", + "last_mailed": "2026-11-02", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Helm chart upload: unbounded gzip+tar metadata parse before the package-size quota gate (CWE-409/CWE-400 decompression amplification)" + }, "dooplex:gitea/gitea|GHSA-r96c-jc75-rxv6": { "first": "2026-10-28", "last_mailed": "2026-10-28", @@ -1056,6 +1152,12 @@ "silent": "first read after the seed", "summary": "VerifyCert maps SSH certificate principals onto other users' SSH public keys" }, + "dooplex:gitea/gitea|GHSA-vmrc-8q2x-573x": { + "first": "2026-11-02", + "last_mailed": "2026-11-02", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "API Issue Mutation Archive Restriction Bypass" + }, "dooplex:gitea/gitea|GHSA-vrhc-jjfc-m3m3": { "first": "2026-10-28", "last_mailed": "2026-10-28", @@ -1118,6 +1220,12 @@ "silent": "first read after the seed", "summary": "Locked issues and comments still accept reactions through the web UI" }, + "dooplex:gitea/gitea|GHSA-wxcq-p34j-7cjj": { + "first": "2026-11-02", + "last_mailed": "2026-11-02", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Public-only tokens expose private repositories through profile and organization tabs" + }, "dooplex:gitea/gitea|GHSA-x4q3-gcj3-m6cf": { "first": "2026-10-27", "last_mailed": "2026-10-27", @@ -1131,6 +1239,12 @@ "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Repository migration skips public-only token guard for private repository creation" }, + "dooplex:gitea/gitea|GHSA-x5v4-836g-f95x": { + "first": "2026-11-02", + "last_mailed": "2026-11-02", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Deprecated POST /org/{org}/repos skips rejectPublicOnly; public-only tokens can create private repositories" + }, "dooplex:gitea/gitea|GHSA-x77v-q46j-393g": { "first": "2026-10-28", "last_mailed": "2026-10-28", @@ -1255,13 +1369,13 @@ }, "dooplex:louislam/uptime-kuma|release:louislam/uptime-kuma@2.5.7": { "first": "2026-10-26", - "last_mailed": "2026-10-26", + "last_mailed": "2026-11-02", "program": "louislam/uptime-kuma 2.5.5 (uptime-kuma)", "summary": "⬆️ Security Fixes" }, "dooplex:louislam/uptime-kuma|release:louislam/uptime-kuma@2.5.8": { "first": "2026-10-26", - "last_mailed": "2026-10-26", + "last_mailed": "2026-11-02", "program": "louislam/uptime-kuma 2.5.5 (uptime-kuma)", "summary": "⬆️ Security Fixes" }, @@ -1314,7 +1428,7 @@ }, "dooplex:outlinewiki/outline|release:outline/outline@v1.12.0": { "first": "2026-10-26", - "last_mailed": "2026-10-26", + "last_mailed": "2026-11-02", "program": "outlinewiki/outline 1.10.1 (outline)", "summary": "1 which fixes multiple recently disclosed vulnerabilities" }, @@ -1398,7 +1512,7 @@ }, "dooplex:rommapp/romm|release:rommapp/romm@5.4.1": { "first": "2026-10-26", - "last_mailed": "2026-10-26", + "last_mailed": "2026-11-02", "program": "rommapp/romm 5.3.1 (romm)", "summary": "While we don't believe RomM instances are vulnerable, we recommend upgrading as soon as possible" }, @@ -1408,6 +1522,12 @@ "program": "vabene1111/recipes 2.6.15 (tandoor-system/tandoor.yaml)", "summary": "Node.js 24.18.1 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process" }, + "dooplex:vaultwarden/server|release:dani-garcia/vaultwarden@1.37.5": { + "first": "2026-11-02", + "last_mailed": "2026-11-02", + "program": "vaultwarden/server 1.37.4 (vaultwarden-system/vaultwarden.yaml)", + "summary": "Security Fixes" + }, "f0rc3/gokapi|GHSA-3c22-5j5m-4jq7": { "first": "2026-10-28", "last_mailed": "2026-10-28", @@ -1581,6 +1701,108 @@ "silent": "first read after the seed", "summary": "Private recipe file and share-link authorization bypass in recipe utility API endpoints" }, + "gitea/gitea|GHSA-32h8-5xqg-h466": { + "first": "2026-11-02", + "last_mailed": "2026-11-02", + "program": "gitea/gitea 28.2.0 (gitea)", + "summary": "Actions: fork workflow gets secrets and write token via review commit_id" + }, + "gitea/gitea|GHSA-37xv-m4w7-j2fh": { + "first": "2026-11-02", + "last_mailed": "2026-11-02", + "program": "gitea/gitea 28.2.0 (gitea)", + "summary": "Public-only tokens bypass private-resource restrictions on the admin API" + }, + "gitea/gitea|GHSA-3fv3-hhmm-4x2q": { + "first": "2026-11-02", + "last_mailed": "2026-11-02", + "program": "gitea/gitea 28.2.0 (gitea)", + "summary": "GET /{user}.rss / .atom leak private activity to a scope-confined API token (2nd incomplete-fix follow-up of GHSA-6cqf-375w-639g, user feed never got the scope-" + }, + "gitea/gitea|GHSA-5j4v-rwqr-vpq7": { + "first": "2026-11-02", + "last_mailed": "2026-11-02", + "program": "gitea/gitea 28.2.0 (gitea)", + "summary": "Gitea web profile and feed routes bypass public-only token scope for limited-visibility users" + }, + "gitea/gitea|GHSA-6h2f-c8jm-84hc": { + "first": "2026-11-02", + "last_mailed": "2026-11-02", + "program": "gitea/gitea 28.2.0 (gitea)", + "summary": "Write collaborators can replace and destroy releases, milestones and labels on archived repositories (archived write-protection bypass)" + }, + "gitea/gitea|GHSA-8g99-g36h-5p2w": { + "first": "2026-11-02", + "last_mailed": "2026-11-02", + "program": "gitea/gitea 28.2.0 (gitea)", + "summary": "Public-only package tokens can access private OCI blobs" + }, + "gitea/gitea|GHSA-8p3x-w464-4g6v": { + "first": "2026-11-02", + "last_mailed": "2026-11-02", + "program": "gitea/gitea 28.2.0 (gitea)", + "summary": "Account Takeover via OAuth2 Auto-Linking with Attacker-Controlled Username" + }, + "gitea/gitea|GHSA-8r36-6j2c-3gmv": { + "first": "2026-11-02", + "last_mailed": "2026-11-02", + "program": "gitea/gitea 28.2.0 (gitea)", + "summary": "Gitea Actions task tokens authenticate to the REST API with no token scope, enabling instance-wide private repository enumeration via GET /api/v1/user/repos" + }, + "gitea/gitea|GHSA-9v6p-xpcp-7488": { + "first": "2026-11-02", + "last_mailed": "2026-11-02", + "program": "gitea/gitea 28.2.0 (gitea)", + "summary": "Stored XSS on the Gitea origin through the v3 artifact Content-Encoding header" + }, + "gitea/gitea|GHSA-c45m-jm46-mwxg": { + "first": "2026-11-02", + "last_mailed": "2026-11-02", + "program": "gitea/gitea 28.2.0 (gitea)", + "summary": "Public project boards disclose private pull request titles and repository names" + }, + "gitea/gitea|GHSA-jh8p-x4ch-389q": { + "first": "2026-11-02", + "last_mailed": "2026-11-02", + "program": "gitea/gitea 28.2.0 (gitea)", + "summary": "Public-Only Token Bypass on Bulk Organization Repository Deletion" + }, + "gitea/gitea|GHSA-jr76-w9m3-3p68": { + "first": "2026-11-02", + "last_mailed": "2026-11-02", + "program": "gitea/gitea 28.2.0 (gitea)", + "summary": "Contribution heatmap discloses private-repository contribution counts to public-only tokens (GetUserHeatmapData never reads ctx.PublicOnly while activity feeds " + }, + "gitea/gitea|GHSA-mf6p-vqpw-3r7x": { + "first": "2026-11-02", + "last_mailed": "2026-11-02", + "program": "gitea/gitea 28.2.0 (gitea)", + "summary": "Actions token can spoof instance-signed commits by adding a GPG key" + }, + "gitea/gitea|GHSA-p86q-78gw-8f3f": { + "first": "2026-11-02", + "last_mailed": "2026-11-02", + "program": "gitea/gitea 28.2.0 (gitea)", + "summary": "Cross-repository issue dependency and timeline read path serializes private issue title/body and attachments without the source repository access check (LoadDep" + }, + "gitea/gitea|GHSA-q9gm-9c7q-c5hq": { + "first": "2026-11-02", + "last_mailed": "2026-11-02", + "program": "gitea/gitea 28.2.0 (gitea)", + "summary": "OIDC userinfo: the public-only token scope is not enforced when the token arrives as a query parameter (residual of CVE-2026-55982)" + }, + "gitea/gitea|GHSA-qcgm-ggp8-22qc": { + "first": "2026-11-02", + "last_mailed": "2026-11-02", + "program": "gitea/gitea 28.2.0 (gitea)", + "summary": "Public-only PAT scope bypass via Actions runner registration leaks private repository secrets" + }, + "gitea/gitea|GHSA-r6mh-qg79-rqj2": { + "first": "2026-11-02", + "last_mailed": "2026-11-02", + "program": "gitea/gitea 28.2.0 (gitea)", + "summary": "Helm chart upload: unbounded gzip+tar metadata parse before the package-size quota gate (CWE-409/CWE-400 decompression amplification)" + }, "gitea/gitea|GHSA-rqhx-647v-wx32": { "first": "2026-10-27", "last_mailed": "2026-10-27", @@ -1588,6 +1810,30 @@ "silent": "first read after the seed", "summary": "SSRF via HTTP Redirect in Repository Migration" }, + "gitea/gitea|GHSA-vmrc-8q2x-573x": { + "first": "2026-11-02", + "last_mailed": "2026-11-02", + "program": "gitea/gitea 28.2.0 (gitea)", + "summary": "API Issue Mutation Archive Restriction Bypass" + }, + "gitea/gitea|GHSA-wxcq-p34j-7cjj": { + "first": "2026-11-02", + "last_mailed": "2026-11-02", + "program": "gitea/gitea 28.2.0 (gitea)", + "summary": "Public-only tokens expose private repositories through profile and organization tabs" + }, + "gitea/gitea|GHSA-x5v4-836g-f95x": { + "first": "2026-11-02", + "last_mailed": "2026-11-02", + "program": "gitea/gitea 28.2.0 (gitea)", + "summary": "Deprecated POST /org/{org}/repos skips rejectPublicOnly; public-only tokens can create private repositories" + }, + "gitea/gitea|release:go-gitea/gitea@v28.3.0": { + "first": "2026-11-02", + "last_mailed": "2026-11-02", + "program": "gitea/gitea 28.2.0 (gitea)", + "summary": "0 [security] ( #40050 ) ( #40051 )" + }, "glanceapp/glance|GHSA-r225-jhr6-68cc": { "first": "2026-10-27", "last_mailed": "2026-10-27", @@ -1643,61 +1889,61 @@ }, "gtstef/filebrowser|GHSA-26fh-r34c-qxh6": { "first": "2026-10-26", - "last_mailed": "2026-10-26", + "last_mailed": "2026-11-02", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "Moving or renaming a folder retargets public shares to the whole folder" }, "gtstef/filebrowser|GHSA-3846-gh75-gp3m": { "first": "2026-10-26", - "last_mailed": "2026-10-26", + "last_mailed": "2026-11-02", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "Public upload share AllowReplacements=false is bypassed by override=true (deny only checks unused action=override)" }, "gtstef/filebrowser|GHSA-3j46-5w28-f8p2": { "first": "2026-10-26", - "last_mailed": "2026-10-26", + "last_mailed": "2026-11-02", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "Incomplete symlink-containment remediation: relocated archive symlink allows arbitrary host file write" }, "gtstef/filebrowser|GHSA-4fhx-8pf6-5gmr": { "first": "2026-10-26", - "last_mailed": "2026-10-26", + "last_mailed": "2026-11-02", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "Duplicate finder can show another user’s restricted file names from a shared cache" }, "gtstef/filebrowser|GHSA-4v62-884x-2466": { "first": "2026-10-26", - "last_mailed": "2026-10-26", + "last_mailed": "2026-11-02", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "Read-only sources (`readOnly: true`) can be written and deleted through WebDAV, archive/unarchive and the OnlyOffice save callback" }, "gtstef/filebrowser|GHSA-4vrc-935w-xxq2": { "first": "2026-10-26", - "last_mailed": "2026-10-26", + "last_mailed": "2026-11-02", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "Per-path access DENY rule bypass via filesystem name aliases (case variant, Windows 8.3 short name, trailing-dot) — access rules evaluated before path canonical" }, "gtstef/filebrowser|GHSA-4wmj-rq3c-m65v": { "first": "2026-10-26", - "last_mailed": "2026-10-26", + "last_mailed": "2026-11-02", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "Improper session revocation allows authentication bypass via revoked-JWT resurrection in `extractUserFromExpiredToken`" }, "gtstef/filebrowser|GHSA-55mw-cwg7-m8f5": { "first": "2026-10-26", - "last_mailed": "2026-10-26", + "last_mailed": "2026-11-02", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "`GET /public/api/media/metadata` returns file content to anonymous share visitors, ignoring the share's download limit and file-viewer setting" }, "gtstef/filebrowser|GHSA-6gr6-5qpq-888p": { "first": "2026-10-26", - "last_mailed": "2026-10-26", + "last_mailed": "2026-11-02", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "Privilege Escalation: Restricted Custom API Token Can Be Upgraded to a Full-Permission Session Token via /api/auth/renew in FileBrowser Quantum" }, "gtstef/filebrowser|GHSA-8655-2ph3-q7q7": { "first": "2026-10-26", - "last_mailed": "2026-10-26", + "last_mailed": "2026-11-02", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "Authenticated Modify-only user can create new files through WebDAV PUT despite Create permission being disabled" }, @@ -1709,145 +1955,145 @@ }, "gtstef/filebrowser|GHSA-8m35-wcjh-95q7": { "first": "2026-10-26", - "last_mailed": "2026-10-26", + "last_mailed": "2026-11-02", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "Logout Bypass via Alternate JWT Spelling" }, "gtstef/filebrowser|GHSA-9fcr-gm58-p839": { "first": "2026-10-26", - "last_mailed": "2026-10-26", + "last_mailed": "2026-11-02", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "Share directory-archive download skips per-user access rules, exposing admin-denied content to anonymous share visitors" }, "gtstef/filebrowser|GHSA-9wm6-jcjh-3m8c": { "first": "2026-10-26", - "last_mailed": "2026-10-26", + "last_mailed": "2026-11-02", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "Stored XSS via Unsanitized DOCX Hyperlink in DocViewer" }, "gtstef/filebrowser|GHSA-c7pj-xjp9-x4xp": { "first": "2026-10-26", - "last_mailed": "2026-10-26", + "last_mailed": "2026-11-02", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "Read-only users can overwrite files through PUT /api/resources" }, "gtstef/filebrowser|GHSA-c84q-q5g6-r47f": { "first": "2026-10-26", - "last_mailed": "2026-10-26", + "last_mailed": "2026-11-02", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "createUserDir: new accounts named `..` or `b..ob` are given the folder that holds every user's home, or another user's home (cross-user read and write)" }, "gtstef/filebrowser|GHSA-c9cr-w724-gqj3": { "first": "2026-10-26", - "last_mailed": "2026-10-26", + "last_mailed": "2026-11-02", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "Session tokens issued in the same second are identical, so a low-privilege user's session can resolve to another user, including an admin" }, "gtstef/filebrowser|GHSA-cw65-p35p-633w": { "first": "2026-10-26", - "last_mailed": "2026-10-26", + "last_mailed": "2026-11-02", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "FileBrowser Quantum: file-upload / mkdir authorization uses the scope-relative path, bypassing per-user access-rule denials (write into a restricted directory)" }, "gtstef/filebrowser|GHSA-g2q5-r6ch-v25f": { "first": "2026-10-26", - "last_mailed": "2026-10-26", + "last_mailed": "2026-11-02", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "FileBrowser Quantum authenticated arbitrary file read via symlink following on the preview read path (incomplete fix of GHSA-mgqf-5mf5-prfj)" }, "gtstef/filebrowser|GHSA-gfgm-886h-6r47": { "first": "2026-10-26", - "last_mailed": "2026-10-26", + "last_mailed": "2026-11-02", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "Custom API token with no global caps inherits owner admin access" }, "gtstef/filebrowser|GHSA-mgqf-5mf5-prfj": { "first": "2026-10-26", - "last_mailed": "2026-10-26", + "last_mailed": "2026-11-02", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "Symlink following escapes user scope allowing arbitrary file read outside the served directory" }, "gtstef/filebrowser|GHSA-p7x3-p5jj-9xfh": { "first": "2026-10-26", - "last_mailed": "2026-10-26", + "last_mailed": "2026-11-02", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "Incomplete remediation of GHSA-55mw-cwg7-m8f5: public media routes bypass share restrictions" }, "gtstef/filebrowser|GHSA-p93p-v944-4p44": { "first": "2026-10-26", - "last_mailed": "2026-10-26", + "last_mailed": "2026-11-02", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "Unarchive writes into folders denied by access rules and overwrites files without modify permission" }, "gtstef/filebrowser|GHSA-p9wm-f5jj-75pj": { "first": "2026-10-26", - "last_mailed": "2026-10-26", + "last_mailed": "2026-11-02", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "FileBrowser Quantum SSE EventRouter Concurrent Map Iteration/Write DoS" }, "gtstef/filebrowser|GHSA-qqf3-2wvq-q4w9": { "first": "2026-10-26", - "last_mailed": "2026-10-26", + "last_mailed": "2026-11-02", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "Archive download follows symlinks out of source scope (arbitrary file read)" }, "gtstef/filebrowser|GHSA-qv53-4557-m65h": { "first": "2026-10-26", - "last_mailed": "2026-10-26", + "last_mailed": "2026-11-02", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "Improper authorization in public upload endpoint allows anonymous bypass of er-folder DENY ACLs via Scope-Stripped path key" }, "gtstef/filebrowser|GHSA-qx86-4v5r-26g5": { "first": "2026-10-26", - "last_mailed": "2026-10-26", + "last_mailed": "2026-11-02", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "MFA bypass and account takeover via unauthenticated TOTP re-enrollment in FileBrowser Quantum (`/api/auth/otp/generate` + `/api/auth/otp/verify`)" }, "gtstef/filebrowser|GHSA-r744-4vm3-2px3": { "first": "2026-10-26", - "last_mailed": "2026-10-26", + "last_mailed": "2026-11-02", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "Passkey MFA factor can be wiped, overwritten or attacker-enrolled with only a session cookie, bypassing the password re-authentication enforced for TOTP and pas" }, "gtstef/filebrowser|GHSA-rmjp-pfrq-cc3v": { "first": "2026-10-26", - "last_mailed": "2026-10-26", + "last_mailed": "2026-11-02", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "Stored XSS in the File Size Analyzer tooltip (unescaped v-html) with a nonce-CSP bypass via an allowlisted CDN" }, "gtstef/filebrowser|GHSA-rqqq-wv83-rp74": { "first": "2026-10-26", - "last_mailed": "2026-10-26", + "last_mailed": "2026-11-02", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "Absolute Path Traversal Bypass in SanitizeUserPath allows authenticated arbitrary file read outside user scope" }, "gtstef/filebrowser|GHSA-vvm6-jwrf-hgmg": { "first": "2026-10-26", - "last_mailed": "2026-10-26", + "last_mailed": "2026-11-02", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": " Stored XSS via HTML Preview — `