CVE-2025-27413 PwnDoc Arbitrary File Write to RCE using Path Traversal in template update from backup templates.json

PwnDoc is a penetration test reporting application. Prior to version 1.2.0, the backup restore functionality allows an administrator to import raw data into the database, including Path Traversal ../ sequences. This is problematic for the template update functionality as it uses the path from the...

CVE-2025-27413

Summary of CVE-2025-27413 (PwnDoc) : Prior to version 1.2.0, PwnDoc’s backup restore functionality accepts raw data containing Path Traversal sequences (../). The template update process uses the database path to write content, which can overwrite source code and enable Remote Code Execution (RCE...

CVE-2025-27410

PwnDoc prior to version 1.2.0 is affected by a path traversal in the backup restore TAR entry name, allowing an attacker with backups:create and backups:update (typically admins) to overwrite arbitrary files and induce Remote Code Execution after restarting the container. The issue is fixed in ve...

CVE-2025-27410 PwnDoc Arbitrary File Write to RCE using Path Traversal in backup restore as admin

PwnDoc is a penetration test reporting application. Prior to version 1.2.0, the backup restore functionality is vulnerable to path traversal in the TAR entry's name, allowing an attacker to overwrite any file on the system with their content. By overwriting an included .js file and restarting the...

CVE-2025-27410 PwnDoc Arbitrary File Write to RCE using Path Traversal in backup restore as admin

PwnDoc is a penetration test reporting application. Prior to version 1.2.0, the backup restore functionality is vulnerable to path traversal in the TAR entry's name, allowing an attacker to overwrite any file on the system with their content. By overwriting an included .js file and restarting the...

CVE-2025-27410 PwnDoc Arbitrary File Write to RCE using Path Traversal in backup restore as admin

PwnDoc is a penetration test reporting application. Prior to version 1.2.0, the backup restore functionality is vulnerable to path traversal in the TAR entry's name, allowing an attacker to overwrite any file on the system with their content. By overwriting an included .js file and restarting the...

PT-2025-9135 · Pwndoc · Pwndoc

Name of the Vulnerable Software and Affected Versions: PwnDoc versions prior to 1.2.0 Description: The issue concerns the backup restore functionality, which allows an administrator to import raw data into the database, including Path Traversal ../ sequences. This is problematic for the template...

PwnDoc 安全漏洞

PwnDoc is a penetration test report generator from PwnDoc open source. A security vulnerability exists in PwnDoc versions prior to 1.2.0 that stems from a path traversal in the backup recovery feature that could lead to remote code execution...

CVE-2024-55602

PwnDoc is a penetration test report generator. Prior to commit 1d4219c596f4f518798492e48386a20c6e9a2fe6, an authenticated user who is able to update and download templates can inject path traversal ../ sequences into the file extension property to read arbitrary files on the system. Commit...

CVE-2025-23044

PwnDoc is a penetration test report generator. There is no CSRF protection in pwndoc, allowing attackers to send requests on a logged-in user's behalf. This includes GET and POST requests due to the missing SameSite= attribute on cookies and the ability to refresh cookies. Commit...

CVE-2025-23044

PwnDoc (pwndoc) is affected by a CSRF vulnerability due to missing protection and SameSite cookies, enabling cross-site requests on behalf of authenticated users. The issue is associated with the project commit 14acb704891245bf1703ce6296d62112e85aa995, which patches the vulnerability. Public desc...

CVE-2025-23044 Cross-Site Request Forgery (CSRF) allows creating admin account with POST request

PwnDoc is a penetration test report generator. There is no CSRF protection in pwndoc, allowing attackers to send requests on a logged-in user's behalf. This includes GET and POST requests due to the missing SameSite= attribute on cookies and the ability to refresh cookies. Commit...

CVE-2025-23044 Cross-Site Request Forgery (CSRF) allows creating admin account with POST request

PwnDoc is a penetration test report generator. There is no CSRF protection in pwndoc, allowing attackers to send requests on a logged-in user's behalf. This includes GET and POST requests due to the missing SameSite= attribute on cookies and the ability to refresh cookies. Commit...

CVE-2025-23044 Cross-Site Request Forgery (CSRF) allows creating admin account with POST request

PwnDoc is a penetration test report generator. There is no CSRF protection in pwndoc, allowing attackers to send requests on a logged-in user's behalf. This includes GET and POST requests due to the missing SameSite= attribute on cookies and the ability to refresh cookies. Commit...

PT-2025-4789 · Pwndoc · Pwndoc

Name of the Vulnerable Software and Affected Versions: PwnDoc versions prior to the version that includes commit 14acb704891245bf1703ce6296d62112e85aa995 Description: PwnDoc is a penetration test report generator that lacks CSRF protection, allowing attackers to send requests on a logged-in user'...

PwnDoc 跨站请求伪造漏洞

PwnDoc is a penetration test report generator from PwnDoc open source. PwnDoc suffers from a cross-site request forgery vulnerability that stems from the lack of cross-site request forgery protection. An attacker exploiting this vulnerability could send GET and POST requests on behalf of a...

The vulnerability of PwnDoc’s asynchronous interface functions in audit tools for automation of report generation allows a perpetrator to trigger a service failure.

The vulnerability of the asynchronous interface function of the PwnDoc automation tool for generating report documents is related to insufficient verification of input data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to cause service failures...

The vulnerability of the res.download() function in the template.js script (located at backend/src/routes/template.js), a documentation generation tool from PwnDoc, allows a hacker to read arbitrary files.

The vulnerability of the res.download function in the template.js script located at backend/src/routes/template.js, a tool for automating report document formatting by PwnDoc, is related to an incorrect restriction on the path to the restricted directory. Exploiting this vulnerability could allow...

PwnDoc 安全漏洞

PwnDoc is a penetration test report generator from PwnDoc open source. A security vulnerability exists in PwnDoc that stems from the ability for an attacker to write a malicious docx template containing expressions that escape the JavaScript sandbox to execute arbitrary code on a system...

CVE-2024-55652 PwnDoc Server-Side Template Injection vulnerability - Sandbox Escape to RCE using custom filters

PenDoc is a penetration testing reporting application. Prior to commit 1d4219c596f4f518798492e48386a20c6e9a2fe6, an attacker can write a malicious docx template containing expressions that escape the JavaScript sandbox to execute arbitrary code on the system. An attacker who can control the...