PT-2023-20007

Name of the Vulnerable Software and Affected Versions Docmosis Tornado versions prior to 2.9.5 Description An issue allows an unauthenticated attacker to bypass the authentication check filter completely by introducing a specially crafted request with relative path segments. Recommendations For...

CVE-2023-25266

Docmosis Tornado prior to 2.9.5 is affected. An authenticated attacker can modify the Office directory setting to point to an arbitrary remote network path, causing the soffice binary to execute under the attacker’s control and enabling arbitrary remote code execution (RCE). Impact is high (CVE-2...