automation-controller: automation-controller-container: automation-controller: CUSTOM_VENV_PATH setting provides filesystem path-existence oracle on control pod

StringListPathField.tointernalvalue calls os.path.exists on unbounded user-supplied paths. 200 vs 400 response reveals existence of arbitrary absolute paths on the controller-web pod. Tenant superuser can confirm /etc/tower/SECRETKEY, k8s service-account token, receptor sockets, ConfigMap mount...

automation-controller: automation-controller-container: automation-controller: CUSTOM_VENV_PATH setting provides filesystem path-existence oracle on control pod

StringListPathField.tointernalvalue calls os.path.exists on unbounded user-supplied paths. 200 vs 400 response reveals existence of arbitrary absolute paths on the controller-web pod. Tenant superuser can confirm /etc/tower/SECRETKEY, k8s service-account token, receptor sockets, ConfigMap mount...

CVE-2026-71462 Automation-controller: automation-controller-container: automation-controller: custom_venv_path setting provides filesystem path-existence oracle on control pod

StringListPathField.tointernalvalue calls os.path.exists on unbounded user-supplied paths. 200 vs 400 response reveals existence of arbitrary absolute paths on the controller-web pod. Tenant superuser can confirm /etc/tower/SECRETKEY, k8s service-account token, receptor sockets, ConfigMap mount...

CVE-2026-71462 Automation-controller: automation-controller-container: automation-controller: custom_venv_path setting provides filesystem path-existence oracle on control pod

StringListPathField.tointernalvalue calls os.path.exists on unbounded user-supplied paths. 200 vs 400 response reveals existence of arbitrary absolute paths on the controller-web pod. Tenant superuser can confirm /etc/tower/SECRETKEY, k8s service-account token, receptor sockets, ConfigMap mount...

CVE-2026-95703

In MISP, the OrganisationsController::uploadLogo method processed a caller-supplied tmpname value with filesystem probes fileexists, MIME type detection, EXIF reading before verifying that the value corresponded to a genuine PHP file upload via isuploadedfile. An authenticated site-admin user cou...

CVE-2026-95703 MISP OrganisationsController File Existence and Image-Type Oracle via Forged Upload tmp_name

In MISP, the OrganisationsController::uploadLogo method processed a caller-supplied tmpname value with filesystem probes fileexists, MIME type detection, EXIF reading before verifying that the value corresponded to a genuine PHP file upload via isuploadedfile. An authenticated site-admin user cou...

EUVD-2026-84495

The findOrgImage method in MISP's OrgImgHelper constructs a filesystem path by concatenating a user-supplied organization identifier with a fixed image directory and a file extension, then calls fileexists on the resulting path. The organization name field is attacker-controllable through event...

CVE-2026-95698

MISP's OrgImgHelper::findOrgImage method builds a filesystem path by concatenating a user-supplied organization name (settable via event import) with a fixed image directory and extension, then calls file_exists() on the result. Because no validation is performed before path construction, an atta...

CVE-2026-95698: Improper Limitation of a Pathname to a Restricted Directory

The findOrgImage method in MISP's OrgImgHelper constructs a filesystem path by concatenating a user-supplied organization identifier with a fixed image directory and a file extension, then calls fileexists on the resulting path. The organization name field is attacker-controllable through event...

CVE-2026-95703: Exposure of Sensitive Information to an Unauthorized Actor

In MISP, the OrganisationsController::uploadLogo method processed a caller-supplied tmpname value with filesystem probes fileexists, MIME type detection, EXIF reading before verifying that the value corresponded to a genuine PHP file upload via isuploadedfile. An authenticated site-admin user cou...

CVE-2026-50024

GitHacker is a tool that restores Git repositories from exposed .git directories. In 1.1.7 and earlier, addheadfiletasks parses an attacker-controlled ref path from .git/HEAD and joins unvalidated path segments onto tempdst/.git/logs/, allowing a malicious server to make GitHacker read an arbitra...

CVE-2026-50024 GitHacker: Path traversal in ref/hash parsing enables existence oracle and hex-fragment exfiltration via a malicious .git server

GitHacker is a tool that restores Git repositories from exposed .git directories. In 1.1.7 and earlier, addheadfiletasks parses an attacker-controlled ref path from .git/HEAD and joins unvalidated path segments onto tempdst/.git/logs/, allowing a malicious server to make GitHacker read an arbitra...

EUVD-2026-78777

GitHacker is a tool that restores Git repositories from exposed .git directories. In 1.1.7 and earlier, addheadfiletasks parses an attacker-controlled ref path from .git/HEAD and joins unvalidated path segments onto tempdst/.git/logs/, allowing a malicious server to make GitHacker read an arbitra...

CVE-2026-50024 GitHacker: Path traversal in ref/hash parsing enables existence oracle and hex-fragment exfiltration via a malicious .git server

GitHacker is a tool that restores Git repositories from exposed .git directories. In 1.1.7 and earlier, addheadfiletasks parses an attacker-controlled ref path from .git/HEAD and joins unvalidated path segments onto tempdst/.git/logs/, allowing a malicious server to make GitHacker read an arbitra...

CVE-2026-50024

GitHacker (a tool that restores Git repositories from exposed .git directories) is vulnerable to path traversal in versions 1.1.7 and earlier . The function add_head_file_tasks parses an attacker-controlled ref path from .git/HEAD and joins unvalidated segments onto temp_dst/.git/logs/, while add...

CVE-2026-50024 GitHacker: Path traversal in ref/hash parsing enables existence oracle and hex-fragment exfiltration via a malicious .git server

GitHacker is a tool that restores Git repositories from exposed .git directories. In 1.1.7 and earlier, addheadfiletasks parses an attacker-controlled ref path from .git/HEAD and joins unvalidated path segments onto tempdst/.git/logs/, allowing a malicious server to make GitHacker read an arbitra...

CVE-2026-50024: Improper Limitation of a Pathname to a Restricted Directory

GitHacker is a tool that restores Git repositories from exposed .git directories. In 1.1.7 and earlier, addheadfiletasks parses an attacker-controlled ref path from .git/HEAD and joins unvalidated path segments onto tempdst/.git/logs/, allowing a malicious server to make GitHacker read an arbitra...

PYSEC-2026-3835 GitHacker: Path traversal in ref/hash parsing enables existence oracle and hex-fragment exfiltration via malicious .git server

Summary GitHacker through 1.1.7 did not validate path segments parsed from attacker-controlled .git/HEAD before joining them onto its output directory. A malicious server could coerce GitHacker into reading arbitrary local files. Contents do not stream back wholesale, but the recovery loop turns...

GitHacker: Path traversal in ref/hash parsing enables existence oracle and hex-fragment exfiltration via malicious .git server

SummaryGitHacker through 1.1.7 did not validate path segments parsed from attacker-controlled .git/HEAD before joining them onto its output directory. A malicious server could coerce GitHacker into reading arbitrary local files. Contents do not stream back wholesale, but the recovery loop turns a...

GitHacker: Path traversal in ref/hash parsing enables existence oracle and hex-fragment exfiltration via malicious .git server

Summary GitHacker through 1.1.7 did not validate path segments parsed from attacker-controlled .git/HEAD before joining them onto its output directory. A malicious server could coerce GitHacker into reading arbitrary local files. Contents do not stream back wholesale, but the recovery loop turns...