CVE-2025-59932

Summary: CVE-2025-59932 affects Flag Forge (FlagForgeCTF). From versions 2.0.0 up to before 2.3.1, the /api/resources endpoint allowed POST and DELETE requests without proper authentication or authorization, enabling unauthorized users to create, modify, or delete resources. The issue has been fi...

CVE-2025-59932 FlagForgeCTF Unauthenticated Resource Modification/Deletion

Flag Forge is a Capture The Flag CTF platform. From versions 2.0.0 to before 2.3.1, the /api/resources endpoint previously allowed POST and DELETE requests without proper authentication or authorization. This could have enabled unauthorized users to create, modify, or delete resources on the...

PT-2025-39700

Name of the Vulnerable Software and Affected Versions Flag Forge versions 2.0.0 through 2.3.0 Description The Flag Forge platform contained a security issue where the /api/resources API endpoint permitted POST and DELETE requests without appropriate authentication or authorization. This allowed...

CVE-2024-42056

Retool self-hosted enterprise through 3.40.0 inserts resource authentication credentials into sent data. Credentials for users with "Use" permissions can be discovered by an authenticated attacker via the /api/resources endpoint. The earliest affected version is 3.18.1...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the /locales/resources.json endpoint. An attacker can access any files with the .json extension on the console's pod. Details A Directory Traversal attack also known as path traversal aims to access files and...

PT-2024-36572 · Siyuan · Siyuan

Name of the Vulnerable Software and Affected Versions: SiYuan versions prior to 3.1.16 Description: SiYuan is a personal knowledge management system. The /api/export/exportResources endpoint is vulnerable to arbitrary file read via path traversal. It is possible to manipulate the paths parameter ...

CVE-2024-42056

Retool self-hosted enterprise through 3.40.0 inserts resource authentication credentials into sent data. Credentials for users with "Use" permissions can be discovered by an authenticated attacker via the /api/resources endpoint. The earliest affected version is 3.18.1...

CVE-2024-42056

Retool self-hosted enterprise through 3.40.0 inserts resource authentication credentials into sent data. Credentials for users with "Use" permissions can be discovered by an authenticated attacker via the /api/resources endpoint. The earliest affected version is 3.18.1...

CVE-2024-42056

Retool self-hosted enterprise through 3.40.0 inserts resource authentication credentials into sent data. Credentials for users with "Use" permissions can be discovered by an authenticated attacker via the /api/resources endpoint. The earliest affected version is 3.18.1...

CVE-2024-42056

Retool (self-hosted Enterprise) is affected through versions 3.18.1–3.40.0. The issue arises from inserting resource authentication credentials into sent data, enabling an authenticated attacker with low-privilege permissions (Use) to discover credentials via the /api/resources endpoint. Impact i...

PT-2024-29716 · Retool · Retool

Name of the Vulnerable Software and Affected Versions: Retool self-hosted enterprise versions 3.18.1 through 3.40.0 Description: The issue allows an authenticated attacker to discover credentials for users with "Use" permissions via the "/api/resources" endpoint. This is due to the insertion of...

Path traversal

A vulnerability was found in keycloak, where path traversal using URL-encoded path segments in the request is possible because the resources endpoint applies a transformation of the url path to the file path. Only few specific folder hierarchies can be exposed by this flaw...