417337 matches found
CVE-2026-72834
CVE-2026-72834 affects filebrowser before 2.63.19. The /api/resources checksum branch reads the entire file to compute a digest and returns it without performing a Perm.Download check, allowing an authenticated user with Perm.Download=false to obtain a content-hash oracle (md5/sha1/sha256/sha512)...
CVE-2026-72835
CVE-2026-72835 affects filebrowser before v2.63.21. The issue is that the application fails to canonicalize paths before evaluating access rules, allowing an authenticated user to bypass administrator-defined deny rules by using case-variant or backslash-separated paths. Attackers can request fil...
CVE-2026-72835 filebrowser before v2.63.21 Access Rule Bypass via Path Canonicalization
filebrowser versions before v2.63.21 fail to canonicalize paths before evaluating access rules, allowing authenticated users to bypass administrator-defined deny rules using case-variant or backslash-separated paths. Attackers can request files with alternate path representations that match no ru...
CVE-2026-72835 filebrowser before v2.63.21 Access Rule Bypass via Path Canonicalization
filebrowser versions before v2.63.21 fail to canonicalize paths before evaluating access rules, allowing authenticated users to bypass administrator-defined deny rules using case-variant or backslash-separated paths. Attackers can request files with alternate path representations that match no ru...
EUVD-2026-58649
filebrowser versions before v2.63.21 fail to canonicalize paths before evaluating access rules, allowing authenticated users to bypass administrator-defined deny rules using case-variant or backslash-separated paths. Attackers can request files with alternate path representations that match no ru...
CVE-2026-72834
filebrowser before 2.63.19 contains a permission bypass in the /api/resources endpoint. The checksum ?checksum= branch of resourceGetHandler reads the entire file to compute a digest and returns it without performing a Perm.Download check unlike the sibling raw, preview, and subtitle paths. As a...
CVE-2026-72835
filebrowser versions before v2.63.21 fail to canonicalize paths before evaluating access rules, allowing authenticated users to bypass administrator-defined deny rules using case-variant or backslash-separated paths. Attackers can request files with alternate path representations that match no ru...
CVE-2026-72834 filebrowser before 2.63.19 Permission Bypass via checksum
filebrowser before 2.63.19 contains a permission bypass in the /api/resources endpoint. The checksum ?checksum= branch of resourceGetHandler reads the entire file to compute a digest and returns it without performing a Perm.Download check unlike the sibling raw, preview, and subtitle paths. As a...
CVE-2026-72834 filebrowser before 2.63.19 Permission Bypass via checksum
filebrowser before 2.63.19 contains a permission bypass in the /api/resources endpoint. The checksum ?checksum= branch of resourceGetHandler reads the entire file to compute a digest and returns it without performing a Perm.Download check unlike the sibling raw, preview, and subtitle paths. As a...
CVE-2026-72834 filebrowser before 2.63.19 Permission Bypass via checksum
filebrowser before 2.63.19 contains a permission bypass in the /api/resources endpoint. The checksum ?checksum= branch of resourceGetHandler reads the entire file to compute a digest and returns it without performing a Perm.Download check unlike the sibling raw, preview, and subtitle paths. As a...
EUVD-2026-58648
filebrowser before 2.63.19 contains a permission bypass in the /api/resources endpoint. The checksum ?checksum= branch of resourceGetHandler reads the entire file to compute a digest and returns it without performing a Perm.Download check unlike the sibling raw, preview, and subtitle paths. As a...
CVE-2026-72832
Grav before 2.0.13 (versions 1.5.2–2.0.12) contains a stored XSS in Security::detectXss() (system/src/Grav/Common/Security.php). The event-handler detector uses a pattern anchored at “]*?, which fails when a > appears inside a quoted attribute value, allowing a payload such as ” onerror=alert(...
CVE-2026-72832
Grav versions from 1.5.2 through 2.0.12 contain a stored cross-site scripting vulnerability in the Security::detectXss function system/src/Grav/Common/Security.php. The event-handler scan is anchored at ?, which cannot cross the first literal ; when a appears inside a quoted attribute value the...
EUVD-2026-58646
Grav versions from 1.5.2 through 2.0.12 contain a stored cross-site scripting vulnerability in the Security::detectXss function system/src/Grav/Common/Security.php. The event-handler scan is anchored at ?, which cannot cross the first literal ; when a appears inside a quoted attribute value the...
CVE-2026-72832 Grav before 2.0.12 Stored XSS via quoted-attribute bypass
Grav versions from 1.5.2 through 2.0.12 contain a stored cross-site scripting vulnerability in the Security::detectXss function system/src/Grav/Common/Security.php. The event-handler scan is anchored at ?, which cannot cross the first literal ; when a appears inside a quoted attribute value the...
CVE-2026-72832 Grav before 2.0.12 Stored XSS via quoted-attribute bypass
Grav versions from 1.5.2 through 2.0.12 contain a stored cross-site scripting vulnerability in the Security::detectXss function system/src/Grav/Common/Security.php. The event-handler scan is anchored at ?, which cannot cross the first literal ; when a appears inside a quoted attribute value the...
CVE-2026-72832 Grav before 2.0.12 Stored XSS via quoted-attribute bypass
Grav versions from 1.5.2 through 2.0.12 contain a stored cross-site scripting vulnerability in the Security::detectXss function system/src/Grav/Common/Security.php. The event-handler scan is anchored at ?, which cannot cross the first literal ; when a appears inside a quoted attribute value the...
CVE-2026-72831
The CVE concerns the Grav Flex Objects plugin (through 1.4.6, tested with Grav 2.0.11). The vulnerability resides in FlexApiController::update(), which only enforces general Flex directory permissions and omits the stricter checks enforced by Users and Groups APIs (target/field/super-admin). An a...
CVE-2026-72830
Grav API plugin versions before 1.0.13 fail to enforce API key scope caps in ConfigController super-scope gates, allowing scoped keys to write scheduler configuration. Attackers with a scoped api.config.write key can inject arbitrary commands into scheduler.customjobs that execute via Symfony...
CVE-2026-72830 Grav API Plugin before 1.0.13 RCE via ConfigController scope bypass
Grav API plugin versions before 1.0.13 fail to enforce API key scope caps in ConfigController super-scope gates, allowing scoped keys to write scheduler configuration. Attackers with a scoped api.config.write key can inject arbitrary commands into scheduler.customjobs that execute via Symfony...