CVE-2025-68436 Craft CMS vulnerable to potential information disclosure via unchecked asset relocation

Craft is a platform for creating digital experiences. In versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16, authenticated users on a Craft installation could potentially expose sensitive assets via their user profile photo via maliciously crafted requests. Users should update to the...

Craft CMS vulnerable to potential information disclosure via unchecked asset relocation

Authenticated users on a Craft installation could potentially expose sensitive assets via their user profile photo via maliciously crafted requests. Users should update to the patched versions 5.8.21 and 4.16.17 to mitigate the issue. Resources:...

Incorrect Authorization

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Incorrect Authorization due to unchecked asset relocation in user profile photos. Remediation Upgrade craftcms/cms to version 4.16.17, 5.8.21 or higher. References - GitHub Commit Credit: Z3r...

GHSA-53VF-C43H-J2X9 Craft CMS vulnerable to potential information disclosure via unchecked asset relocation

Authenticated users on a Craft installation could potentially expose sensitive assets via their user profile photo via maliciously crafted requests. Users should update to the patched versions 5.8.21 and 4.16.17 to mitigate the issue. Resources:...

PT-2026-27135

Name of the Vulnerable Software and Affected Versions GNU Binutils versions affected versions not specified Description A flaw exists in the GNU Binutils BFD library, a component used for handling binary files. The issue arises when processing specially crafted XCOFF object files, specifically du...

SUSE CVE-2023-54253

In the Linux kernel, the following vulnerability has been resolved: btrfs: set page extent mapped after readfolio in relocateonepage One of the CI runs triggered the following panic assertion failed: PagePrivatepage && page-private, in fs/btrfs/subpage.c:229 ------------ cut here ------------...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-993031)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-993031 advisory. In the Linux kernel, the following vulnerability has been resolved: btrfs: unset reloc control if transaction commit fails in preparetorelocate In...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-993173)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-993173 advisory. In the Linux kernel, the following vulnerability has been resolved: btrfs: fix a NULL pointer dereference when failed to start a new trasacntion BUG Syzbot reported ...

CVE-2023-54253

In the Linux kernel, the following vulnerability has been resolved: btrfs: set page extent mapped after readfolio in relocateonepage One of the CI runs triggered the following panic assertion failed: PagePrivatepage && page-private, in fs/btrfs/subpage.c:229 ------------ cut here ------------...

UBUNTU-CVE-2023-54253

In the Linux kernel, the following vulnerability has been resolved: btrfs: set page extent mapped after readfolio in relocateonepage One of the CI runs triggered the following panic assertion failed: PagePrivatepage && page-private, in fs/btrfs/subpage.c:229 ------------ cut here ------------...

CVE-2023-54253

In the Linux kernel, the following vulnerability has been resolved: btrfs: set page extent mapped after readfolio in relocateonepage One of the CI runs triggered the following panic assertion failed: PagePrivatepage && page-private, in fs/btrfs/subpage.c:229 ------------ cut here ------------...

CVE-2023-54253

The CVE describes a Linux kernel bug in Btrfs relocation: calling set_page_extent_mapped before validating the folio/page can trigger a kernel BUG during relocate_one_page. The fix, as noted in the description, is to move set_page_extent_mapped to after the btrfs_read_folio block so the subpage b...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2025-992613)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992613 advisory. In the Linux kernel, the following vulnerability has been resolved: btrfs: unset reloc control if transaction commit fails in preparetorelocate In...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-992521)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992521 advisory. In the Linux kernel, the following vulnerability has been resolved: btrfs: unset reloc control if transaction commit fails in preparetorelocate In...

Linux Distros Unpatched Vulnerability : CVE-2023-54253

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - btrfs: set page extent mapped after readfolio in relocateonepage One of the CI runs triggered the following panic assertion failed: PagePrivatepage &&...

Linux Distros Unpatched Vulnerability : CVE-2023-54080

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - btrfs: zoned: skip splitting and logical rewriting on pre-alloc write When doing a relocation, there is a chance that at the time of btrfsrelocclonecsums, there...

SUSE CVE-2023-54080

In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: skip splitting and logical rewriting on pre-alloc write When doing a relocation, there is a chance that at the time of btrfsrelocclonecsums, there is no checksum for the corresponding region. In this case,...

SUSE CVE-2023-54121

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix incorrect splitting in btrfsdropextentmaprange In production we were seeing a variety of WARNON's in the extentmap code, specifically in btrfsdropextentmaprange when we have to call addextentmapping for our second spli...

EUVD-2023-60324

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix incorrect splitting in btrfsdropextentmaprange In production we were seeing a variety of WARNON's in the extentmap code, specifically in btrfsdropextentmaprange when we have to call addextentmapping for our second spli...

EUVD-2023-60365

In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: skip splitting and logical rewriting on pre-alloc write When doing a relocation, there is a chance that at the time of btrfsrelocclonecsums, there is no checksum for the corresponding region. In this case,...