CVE-2024-10081

CodeChecker (analyzer tooling for Clang) is affected by CVE-2024-10081 through version 6.24.1. The vulnerability is an authentication bypass triggered when the API URL ends with Authentication, Configuration, or ServerInfo, allowing superuser access to all API endpoints other than Authentication,...

CVE-2024-53829

CodeChecker exposes a Cross-Site Request Forgery (CSRF) vulnerability in its API affecting CodeChecker up to version 6.24.4. An unauthenticated attacker can leverage a forged request to perform actions with the victim’s session, including adding, removing, or editing products, provided they know ...

CVE-2025-1300

CVE-2025-1300 — Open redirect in CodeChecker web server . The issue is in the CodeChecker web server where insufficient protection against multiple slashes after the product name in the URL allows an open redirect, bypassing protections related to CVE-2021-28861. Affected software is CodeChecker ...

CVE-2023-49793

CVE-2023-49793 describes a path traversal in CodeChecker server via the massStoreRun endpoint (CodeCheckerService). ZIPs uploaded to CodeChecker store are not sanitized, allowing reading files from the server with the same permissions as the CodeChecker server. Attack requires a CodeChecker user ...

CVE-2024-10082

Summary (CVE-2024-10082) CodeChecker (Clang Static Analyzer/Tidy tooling) up to version 6.24.1 contains an authentication flaw: an auto-generated built-in root user with superuser permissions that cannot be disabled. An attacker who can create an account on an enabled external authentication serv...

CVE-2026-25660

CVE-2026-25660 affects CodeChecker (analyzer tooling, defect DB, and viewer extension for Clang Static Analyzer and Clang-Tidy) up to version 6.27.3. The issue is an authentication bypass triggered when the URL ends with certain function calls, allowing assignment of arbitrary permissions to any ...

CVE-2025-40843

CodeChecker (analyzer tooling) up to version 6.26.1 contains a buffer overflow in the internal ldlogger library used by the CodeChecker log command. The vulnerability stems from unsafe use of strcpy() into a fixed 4096-byte stack buffer, enabling an attacker to cause a crash or potentially execut...