GitLab CE/EE <=19.1.7/19.2.5/19.3.1 - Arbitrary File Read

GitLab CE/EE contains an unauthenticated arbitrary file read. Workhorse, the reverse proxy in front of Rails, matches upload routes using EscapedPath and path.Clean without decoding percent sequences, while Puma decodes them before routing to Grape. Appending a trailing slash to commits or...

CVE-2024-38819-POC2

CVE-2024-38819: 개념 증명PoC 이것은 제가 보고한 CVE-2024-38819 취약점에 대한 개념 증명PoC으로, 경로 탐색path traversal 공격을 시연합니다. 실행 단계 1. Docker 이미지를 빌드합니다 Spring Boot 3.3.4, Spring Framework 6.1.13 기반 cd vuln docker build -t cve-2024-38819-poc . 2. 컨테이너를 실행하고 포트 8080을 호스트 머신에 노출합니다 docker run -d -p 8080:8080 --name...

CVE-2026-12243-NLTK-PoC

CVE-2026-12243 — NLTK 경로 탐색 실습 환경 NLTK 3.9.4의 퍼센트 인코딩 경로 탐색 동작과 NLTK 3.10.0의 수정된 동작을 대조하는 작고 재현 가능한 Docker 실습 환경입니다. 취약한 버전은 URL 디코딩 전에 리소스 이름을 검증합니다. 고정된 페이로드 %2e%2e/%2e%2e/outside/lab-secret.txt는 검증을 통과한 후 ../../outside/lab-secret.txt로 디코딩되어 구성된 NLTK 데이터 디렉터리와 프로세스 작업 디렉터리를 모두 벗어납니다. 패치된 버전은 동일...

CVE-2021-41773-POC

CVE-2021-41773 취약점 재현 보고서 취약점 개요 CVE ID : CVE-2021-41773 취약점 이름 : Apache HTTP Server 경로 순회 취약점 위험 등급 : 높음 CVSS 7.5 영향 버전 : Apache HTTP Server 2.4.49 취약점 설명 : Apache HTTP Server 2.4.49 버전의 경로 정규화 함수 apnormalizepath 구현 결함으로, 공격자는 %2e 인코딩이 포함된 특수 요청을 구성하여 접근 제어를 우회하고 웹 서버의 임의 파일을 읽을 수 있습니다. 환경 구축 운영...

CVE-2026-66754-Remote-Denial-of-Service-via-Reachable-Assertion-in-URL-Prefix-Handling-rouille-

보안 권고: URL 접두사 처리의 도달 가능한 단언을 통한 원격 서비스 거부 rouille 지정된 CVE ID: CVE-2026-66754 요약 Request::removeprefix는 퍼센트 디코딩된 URL을 검사하지만 원시raw URL에 대해 단언assert합니다. 디코딩된 경로가 접두사로 시작하지만 원시 경로는 그렇지 않은 요청은 검사를 통과한 뒤 단언에 실패합니다. 접두사의 한 문자만 퍼센트 인코딩하면 충분합니다. 기본 빌드에서는 패닉이 포착되어 500으로 처리됩니다. panic = "abort"로 빌드한 경우에는 이를...

CVE-2026-73319

CVE-2026-73319: JavaScript URI accepted as a dynamic redirect XenForo before 2.3.13 accepts a same-host javascript: URI as a dynamic redirect and later assigns it to window.location. What happens Server-side redirect validation rejects foreign hosts but does not require HTTP or HTTPS. A URL shape...

EUVD-2026-78395

fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets...

CVE-2026-95811

Lemonldap::NG::Handler versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow an equivalent spelling of a path to bypass the locationRules that restrict it. The handler matches each vhost's locationRules regular expressions against REQUESTURI, the...

CVE-2026-69201

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, ResourceService and WebjarService decode each URL path segment but reject only segments exactly equal to an empty string, a dot, or two dots. A request containing percent-encoded slash or backslash separators can turn ...

CVE-2026-69201 Http4s: ResourceService and Webjar Service path escape via percent-encoded separators

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, ResourceService and WebjarService decode each URL path segment but reject only segments exactly equal to an empty string, a dot, or two dots. A request containing percent-encoded slash or backslash separators can turn ...

CVE-2026-86818

A flaw was found in fast-uri, a Node.js URI parser. In versions 4.1.3 and 4.1.4, the mailto parser incorrectly handles percent-encoded query field names. This desynchronization between parsing and serialization allows an attacker to inject arbitrary recipients, subjects, or body content into mail...

DEBIAN-CVE-2026-86818

fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv, that added a mailto scheme parser in version 4.1.3. In versions 4.1.3 and 4.1.4, the mailto parser compares each query field name to the reserved names to, subject, and body while the name is still...

CVE-2026-86472

fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv. In versions before 2.4.7, from 3.0.0 through 3.1.7, and from 4.0.0 through 4.1.4, fast-uri folds the host to lowercase before it percent-decodes the host, so a percent-encoded uppercase octet such as %41 decod...

CVE-2026-86472

A flaw was found in fast-uri, a dependency-free URI parser. This vulnerability occurs because the software folds the host to lowercase before percent-decoding it, allowing percent-encoded uppercase characters to bypass this normalization. A remote attacker could exploit this by crafting a malicio...

CVE-2026-86818

fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv, that added a mailto scheme parser in version 4.1.3. In versions 4.1.3 and 4.1.4, the mailto parser compares each query field name to the reserved names to, subject, and body while the name is still...

CVE-2026-86818

fast-uri v4.1.3–4.1.4, a dependency-free RFC 3986 URI parser for Node.js used by Fastify and ajv , suffers from a percent-encoded field-name desynchronization in its mailto parser. At parse time, reserved field names (to, subject, body) are compared in their still-percent-encoded form and thus no...

CVE-2026-86818 fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization

fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv, that added a mailto scheme parser in version 4.1.3. In versions 4.1.3 and 4.1.4, the mailto parser compares each query field name to the reserved names to, subject, and body while the name is still...

CVE-2026-86472

fast-uri is a dependency-free RFC 3986 URI parser for Node.js used by Fastify and ajv . In versions before 2.4.7, 3.0.0–3.1.7, and 4.0.0–4.1.4, the library folds the host to lowercase before percent-decoding, so a percent-encoded uppercase octet (e.g. %41 → A) is never folded. For scheme-relative...

CVE-2026-86818: Encoding Error

fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv, that added a mailto scheme parser in version 4.1.3. In versions 4.1.3 and 4.1.4, the mailto parser compares each query field name to the reserved names to, subject, and body while the name is still...

Linux Distros Unpatched Vulnerability : CVE-2026-86818

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv, that added a mailto scheme parser in version 4.1.3. In versions 4.1.3 an...