rclone: WebDAV Credentials Survive a Same-Host HTTPS-to-HTTP Redirect

Summary WebDAV's default redirect handling can replay Basic authorization and configured Cookie headers over plaintext HTTP after a same-host HTTPS-to-HTTP redirect. This was reproduced through the real backend. Unlike the low-impact STS token in rclone's published S3 redirect advisory, Basic...

rclone: FTP Command Arguments Permit CRLF Injection When Custom Encoding Preserves Newlines

Summary A valid but nondefault FTP filename encoding can restore raw CR/LF immediately before an attacker-controlled path is interpolated into the line-oriented FTP control channel. The dependency does not reject CR or LF in command arguments, so a filename can inject an independent...

rclone: S3 Redirect Sanitization Omits IBM IAM Bearer Tokens and SSE-C Keys

Summary The S3 redirect callback strips X-Amz-Security-Token when a redirect changes scheme or host, but it does not strip IBM IAM bearer authorization or customer-provided encryption keys. Two independently validated paths remain: - a same-host HTTPS-to-HTTP redirect preserves Authorization:...

rclone: Path traversal in serve s3 allows reading and overwriting root-level files

Summary rclone serve s3 allows a client to read and write files at the root of the remote which would normally be inaccessible by using dot-dot path segments in the object key. It does not allow reading files outside of the root. A request such as GET /bucket/../root-secret.txt is handled as an...

rclone: Infinite Scale TUS Creation Transport Error Causes a Nil-Response Panic

Summary A transport failure during the initial Infinite Scale TUS creation POST can return nil response, non-nil error. Rclone dereferences the nil response before processing the error and panics. The production CreateUploader path reproduced the crash against a closed endpoint. The security...

rclone: Unbounded HTTP CONNECT Response Headers Can Exhaust rclone Memory

Summary The shared HTTP CONNECT helper parses a proxy response with http.ReadResponse over an unrestricted buffered reader. The production helper accepted a valid response containing a 2 MiB header in three consecutive runs. A malicious or compromised configured proxy, or an active on-path actor...

rclone: Unvalidated symlink target in local `--links` — arbitrary file write from an untrusted remote

Summary With -l/--links, rclone serializes symlinks as .rclonelink text objects whose body is the link target. When rclone writes such an object to a local destination, it recreates the symlink with os.Symlink, and performs NO validation of the target. If the source is attacker-controlled, the...

rclone: Incomplete path validation allows backend root escape in serve restic

Summary rclone serve restic does not correctly reject URL paths beginning with ../. On affected backends, an attacker who can access the REST endpoint can read, create, overwrite, or delete objects outside the path configured by the operator. The issue affects rclone v1.40 through rclone v1.74.4...

rclone local `--metadata` applies attacker-controlled mode/uid - setuid binary planted from an untrusted remote

Summary When writing an object with metadata, the local backend applies the source-supplied mode, uid, and gid verbatim: it parses mode as an octal integer and passes it straight into os.Chmodo.path, os.FileModeumode, and passes uid/gid straight into os.Chown. The value is never masked to...

rclone: Verbose Stack Trace Disclosure in RC API Error Responses

Summary When an RC API call triggers a panic recovered by the job runner, the full Go stack trace is included in the JSON error response. This leaks internal file paths, Go module versions, goroutine state, and memory addresses to the API caller. Details The panic recovery in...

Electron: Sandboxed iframes can launch external protocol handlers

Impact Requests to open external protocol URLs from web content did not take iframe sandbox restrictions into account, so a sandboxed iframe could cause an OS-registered external application to be launched. The frame's sandbox state was also not made available to the app's permission handlers. Ap...

Electron: DevTools embedder handler executes arbitrary files via shell open

Impact The DevTools "reveal in file manager" action could launch the target file rather than reveal it. An attacker with a separate means of running script inside the DevTools frontend such as a malicious DevTools extension could use this to execute native code outside the sandbox. Apps are only...

Electron: contextBridge object copy honors prototype setters

Impact Objects copied across the contextBridge boundary from untrusted content could carry an attacker-influenced prototype, enabling prototype-pollution-style attacks against preload code despite context isolation being enabled. Apps are only affected if their preload code accepts object argumen...

Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter

Impact The mode option of webContents.openDevTools was not sanitized before use by the DevTools frontend. If an attacker can influence this value, script under their control may run in the DevTools context, which in unsandboxed configurations has access to Node.js. Apps are only affected if...

Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path

Impact A sandboxed iframe without the allow-popups keyword could still open a new window or trigger setWindowOpenHandler with no user interaction, because new-window navigations taking the OpenURL path did not apply the iframe sandbox popup restriction. Apps that embed untrusted content in...

Electron: window.open features string controls some window options considered privileged

Impact Some window options supplied by web content in the window.open features string were applied to the new BrowserWindow without an allowlist. Untrusted content could set window options it should not control, including options that cause the main process to access attacker-chosen file or netwo...

Electron: ProtocolResponse.url reuses the default session cache instead of the registering session

Impact When a custom protocol handler returned a ProtocolResponse with a url and no session, Electron made the upstream request through defaultSession instead of the session that handled the protocol. A cached response could then be reused across otherwise isolated session partitions. Apps that u...

Electron: HTTP redirect followed into local file loader

Impact When following HTTP redirects, net.fetch and net.request did not restrict which schemes a redirect could target. A remote server could redirect a request to a local resource, and if the app returns or forwards the response body, local file contents could be disclosed. Apps are only affecte...

Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads

Impact A custom scheme registered with supportFetchAPI: true but without corsEnabled: true was not subject to CORS enforcement. A page loaded from a remote origin could therefore fetch or XMLHttpRequest that scheme cross-origin and read the full response body, rather than the read being blocked...

Electron: Extension tab APIs operate across session boundaries

Impact Extension tab and scripting APIs were not scoped to the extension's own session. A malicious or compromised extension loaded into one session could navigate, script, and read from windows belonging to a different session. Apps are only affected if they load Chrome extensions via...

Electron: shell.openPath path validation bypass via embedded null byte

Impact shell.openPath did not reject paths containing embedded null bytes. Apps that perform string-only validation of file paths for example, checking the file extension before passing them to shell.openPath could be bypassed, allowing an attacker-controlled path to open a different file than th...

Electron: Context isolation bypass via Function.prototype.bind hijack

Impact Apps that expose Promise-returning functions to web content via contextBridge may be vulnerable to a context isolation bypass. Untrusted web content could obtain access to the isolated preload world and, through it, every capability the preload script has. In renderers without a sandbox, o...

Electron: Cross-origin iframe can position native autofill popup

Impact The native autofill popup could be positioned by a cross-origin iframe outside that iframe's bounds, over the embedding page's UI, enabling clickjacking or spoofing of trusted UI. Apps are only affected if they embed untrusted content in iframes within windows that also display trusted UI...

Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin

Impact For serial-port and media camera / microphone permission checks made from an iframe, the requestingOrigin passed to session.setPermissionCheckHandler was the top-level frame's origin rather than the requesting frame's. Origin-based handler logic could therefore grant a cross-origin iframe...

Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size

Impact In offscreen rendering mode, frame data received from the GPU process was not fully validated by the main process. A compromised GPU process could cause the main process to read out-of-bounds memory while producing paint event images, disclosing memory or crashing the app. Apps are only...

Electron: Parent process code-sign check is spoofable

Impact On macOS, the check Electron uses to confirm it was launched by a same-signed parent process could be bypassed by a local process. Apps that enable the fuse-based hardening restricting ELECTRONRUNASNODE and NODEOPTIONS to same-signed parents rely on this check; a local attacker could bypas...

Ghost Content API filter bypass reveals private fields

Impact The validation applied to filters on the public API endpoints could be partially bypassed, making it possible to reveal private fields via a brute force attack. If SQLite was used as the database password hashes were fully accessible. If MySQL was used as the database the password hashes'...

Ghost: Cross-Site Scripting in Feature Image Captions

Impact An input validation issue allowed any staff user to create a post with content that could be used to hijack another staff user's Ghost Admin session resulting in privilege escalation. Vulnerable versions This vulnerability is present in Ghost from v4.9.0 up to v6.54.0. Patches v6.54.1...

Ghost: Server-Side Request Forgery Mitigation Issue

Impact A validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network. A successful attack would not result in any response data being returned. Vulnerable versions This...

Ghost: Paid gift memberships obtainable at minimal cost via the donations feature

Impact A vulnerability in Ghost's public donation checkout flow allowed an unauthenticated attacker to obtain full paid gift memberships for a minimal payment. No customer or member data was exposed, and the issue could not be used to steal money from a site or its members. Vulnerable versions Th...

Ghost: Member existence leak via magic link sign-in response

Impact A discrepancy in responses from the members signin endpoints made it possible for an unauthenticated attacker to determine whether a given email address belongs to a registered member of a Ghost site. Vulnerable versions This vulnerability is present in Ghost from v5.18.0 up to v6.21.0...

XSS in Ghost's ActivityPub client

Impact The ActivityPub client in Ghost was vulnerable to JavaScript injection on posts shared by a maliciously customised ActivityPub server. Vulnerable Versions This vulnerability is present in the @tryghost/activitypub package up to v3.0.8. All prior versions are also affected. Patches...

Ghost: Session Fixation in Ghost Admin

Impact Ghost Admin did not invalidate existing sessions on login which could have allowed for session fixation attacks. Successful exploitation would have required another vulnerability on the same domain where Ghost Admin was hosted. Vulnerable versions This vulnerability is present in Ghost fro...

Ghost: Theme Upload Path Traversal

Impact A vulnerability in custom themes allowed a staff user to write files outside of the uploads directory. This could be used to alter the behavior of the installation. Vulnerable versions This vulnerability is present in Ghost from v0.10.0 up to v6.54.0. Patches v6.54.1 contains a fix for thi...

Ghost: Database Backup Path Traversal

Impact An Administrator-level user could remotely overwrite certain files on the filesystem leading to integrity and availability issues. Vulnerable versions This vulnerability is present in Ghost from 1.20.1 up to v6.54.0. Patches v6.54.1 contains a fix for this issue. How to update For...

Ghost: Server-Side Request Forgery in Image Fetching

Impact A Server-Side Request Forgery SSRF in Ghost Admin allowed any staff-level user to perform a blind HTTP GET request against internal hosts. No output was returned, but this could have been used to probe open ports on internal hosts. Vulnerable versions This vulnerability is present in Ghost...

Ghost: Blind Password Hash Disclosure in Ghost Admin API

Impact Any staff-level user was able to leak the hashed passwords of other staff users. An offline password-guessing attack against the hashes could lead to account takeover if successful, but Device Verification should have prevented an attacker from logging in with a recovered password. Dependi...

Ghost: Mobiledoc image-size fetch SSRF

Impact When re-rendering posts, Ghost would refetch missing image dimensions by issuing an outbound HTTP request to the URL stored on an image card — without restricting that URL to trusted image hosts. An authenticated staff user able to create or edit posts could therefore point an image card a...

Ghost: Server-side request forgery via DNS rebinding in external request handling

Impact Ghost’s private-IP check for outbound HTTP requests could be bypassed via DNS rebinding, allowing an attacker to coerce the Ghost server into reaching hosts on internal networks through features that issue external fetches. Vulnerable versions This vulnerability is present in Ghost from...

Ghost: Private IP filtering bypass to make server-side requests to internal services

Impact When making an external request, it is possible to bypass the IP filter that ensures the request isn't going to an internal service using an IPv6 literal which maps to a private IPv4 address. Vulnerable versions This vulnerability is present in Ghost from v6.0.9 up to v6.21.0. Patches...

Ghost: Archived Offers can be Redeemed

Impact A missing validation check allowed users to redeem subscription offers that were no longer active. Vulnerable versions This vulnerability is present in Ghost from v4.22.0 up to v6.54.0. Patches v6.54.1 contains a fix for this issue. How to update For self-hosters using Docker, find Docker'...

Ghost: File Upload Content-Type Spoofing

Impact Insufficient validation of the client-supplied Content-Type on Ghost's Admin API file upload endpoint allowed uploaded files to be served from the site with an attacker-chosen content type on S3/GCS storage backends. On installations that serve uploaded files from the same origin as the...

Ghost: Cross-Site Scripting in Universal Import

Impact The Universal Import feature in Ghost Admin failed to properly sanitize imported content resulting in XSS in post content. Vulnerable versions This vulnerability is present in Ghost from v5.26.0 up to v6.54.0. Patches v6.54.1 contains a fix for this issue. How to update For self-hosters...

Open WebUI: A folder write-collaborator can permanently delete the owner's chats by deleting a shared subfolder

Summary A user granted write access to a shared chat folder could permanently delete chats and messages belonging to the folder's owner. Deleting a folder cascades into the owner's chats and the entire subfolder subtree, and the deletion handler required only write access on subfolders instead of...

Open WebUI: Any authenticated user can stall a worker via a knowledge-search pattern that backtracks catastrophically

Summary The built-in knowledge search tools let a chat participant choose the pattern used to grep knowledge files. Patterns containing regex metacharacters were compiled with Python's backtracking re engine and run against every line of every reachable file, with no time limit anywhere on that...

Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages

Summary Any authenticated user can store a chat message whose math block makes KaTeX fail with a stack overflow instead of a parse error. When that happens the renderer falls back to inserting the original math source into the page as HTML rather than as text, so script in the message runs in the...

Open WebUI: Tool source code disclosed to read-only users via the tool list and get endpoints

Summary A workspace tool shared with a read grant returned its full Python source to the recipient. Any authenticated non-admin who could use a shared tool could also read its source, including any user on the instance when a tool was shared publicly. Source is meant to be a writer-only tier: the...

Open WebUI: Unapproved accounts can open terminal sessions via a WebSocket auth path missing the role check

Summary The terminal WebSocket route authenticates its own first-message JWT instead of going through the HTTP dependency chain, and never applies the role check that getverifieduser enforces on every HTTP terminal route. An account whose role is pending, meaning registered but not approved, or...

Open WebUI: Instance-wide stall via automation recurrence rules that force multi-second parsing

Summary In every affected release, automation recurrence parsing anchors minutely and hourly rules at a fixed date of 2000-01-01 and then walks forward one interval at a time to find the next run. A single FREQ=MINUTELY rule therefore enumerates roughly a quarter-century of occurrences,...

Open WebUI: DNS Rebinding SSRF Bypass

Summary Open WebUI vetted user-supplied URLs by resolving the hostname once and rejecting private, loopback and link-local addresses, then let the HTTP client resolve that hostname again at connect time. An attacker who controls the authoritative DNS for a hostname they submit can answer with a...