PT-2026-3876

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 0.1.17 Description The resolveSafeChildPath utility function in @backstage/backend-plugin-api did not properly validate symlink chains and dangling symlinks, leading to a path traversal issue. An attacker could bypa...

PT-2024-40156 · Twig · Twig

Name of the Vulnerable Software and Affected Versions: Twig affected versions not specified Description: The issue allows for path traversal when Twig is used with Twig Loader Filesystem for loading templates and the application uses non-trusted template names. This enables an attacker to access...

PT-2019-1631 · Pallets +3 · Jinja2 +3

Name of the Vulnerable Software and Affected Versions: Jinja2 version 2.10 Description: An issue was discovered in the from string function of Jinja2, which is prone to Server Side Template Injection SSTI. The function takes the source parameter as a template object, renders it, and then returns...