foreman: Safemode Bypass leading to RCE

A flaw was found in Foreman. An authenticated attacker with low-level permissions can achieve remote code execution RCE by bypassing the safemode sandbox within the templating engine. Due to improper handling of delegated methods, an attacker can append unauthorized functions to the allowed...

CVE-2026-96658

A flaw in Foreman allows an authenticated attacker with low-level permissions to achieve remote code execution (RCE) . The vulnerability resides in the templating engine 's safemode sandbox , where improper handling of delegated methods enables an attacker to append unauthorized functions to the ...

CVE-2026-96658 Foreman: safemode bypass leading to rce

A flaw was found in Foreman. An authenticated attacker with low-level permissions can achieve remote code execution RCE by bypassing the safemode sandbox within the templating engine. Due to improper handling of delegated methods, an attacker can append unauthorized functions to the allowed...

CVE-2026-74905

SiYuan before v3.7.4 contains a full-read SSRF vulnerability in the isPrivateIP function (kernel/util/net.go), which powers the SSRFSafeDialer SSRF guard in SafeMode. The function fails to recognize IPv6 transition addresses (NAT64 64:ff9b::/96, 6to4 2002::/16, Teredo 2001::/32) that embed privat...

EUVD-2026-60586

SiYuan before v3.7.4 contains a server-side request forgery SSRF vulnerability in the isPrivateIP function in kernel/util/net.go, used by SSRFSafeDialer to enforce SSRF protection in SafeMode. The function only checks for loopback, link-local unicast, private, and unspecified addresses and does n...

EUVD-2007-1454

Malware in sbrugna...

SUSE CVE-2007-1461

The compress.bzip2:// URL wrapper provided by the bz2 extension in PHP before 4.4.7, and 5.x before 5.2.2, does not implement safemode or openbasedir checks, which allows remote attackers to read bzip2 archives located outside of the intended directories...

PT-2020-16360

Name of the Vulnerable Software and Affected Versions October CMS versions prior to 1.0.470 October CMS versions prior to 1.1.1 Description A bypass was discovered that allows an authenticated backend user with the cms.manage pages, cms.manage layouts, or cms.manage partials permissions to write...

PHP safemode bypass

By using LOADFILE, INTO DUMPFILE, INTO OUTFILE SQL modifiers it's possible to access files behind basedir...

PT-2007-1480 · Php · Php

Name of the Vulnerable Software and Affected Versions: PHP versions prior to 4.4.4 Description: The issue concerns the imap body function, which does not implement safemode or open basedir checks. This allows local users to read arbitrary files or list arbitrary directory contents. Recommendation...