CVE-2026-109391 Square Squash through commit e73f280 Unauthenticated YAML Deserialization via Symbolication API

Square Squash through commit e73f280 contains an insecure deserialization vulnerability that allows unauthenticated attackers to store crafted YAML via the POST /api/1.0/symbolication endpoint. When occurrences referencing the attacker-controlled symbolication UUID are symbolicated, the stored...

CVE-2026-109391

The Square Squash application (through commit e73f280 ) contains an insecure deserialization vulnerability in its Symbolication API . Unauthenticated attackers can use the POST /api/1.0/symbolication endpoint to store crafted YAML data. When the system processes occurrences referencing an attacke...