Komari: Management Interface CSRF

Vulnerability Overview The sessiontoken cookie is set without the SameSite or Secure attributes login.go:68. All /api/admin/ management endpoints rely solely on this cookie for authentication, with no CSRF token or Origin validation. The server-side vulnerability is confirmed to exist; however,...

GHSA-C3JM-GV5R-9WCP Cloudreve WOPI view sessions can write files and WOPI access token secret is ignored

Summary Cloudreve WOPI access tokens are generated as ., but the WOPI middleware validates only the session id prefix and never compares the supplied token to the stored token. In addition, a WOPI viewer session does not store or enforce the requested viewer action. A session created for a view o...