CVE Vulnerability Catalog

Hugo versions from v0.161.0 through v0.165.0 run Node.js tools (css.PostCSS, css.TailwindCSS, js.Babel) under the Node.js permission model to restrict file system reads to the project directory and configured mounts. Because the Node.js permission model validates only the lexical path and follows symbolic links that point outside the allowed set, Hugo did not detect symlinks escaping the sandbox. An attacker who can contribute content to a Hugo project (for example via a pull request) can commit a symlink such as assets/css/x.css -> /etc/passwd together with a PostCSS plugin that reads it, allowing any file readable by the Hugo build process to be disclosed and potentially embedded in the published site. This affects builds using the default security configuration; projects that do not invoke Node.js tools are unaffected. Fixed in v0.166.0, which scans allowed paths and fails the build when a symbolic link resolves outside them.

Budibase versions before 3.45.0 fail to validate per-app authorization in the POST /api/global/groups/:groupId/apps endpoint, allowing builders to assign application roles across workspace boundaries. A builder of a single workspace can exploit missing per-app authorization checks to grant themselves admin roles in other workspaces by modifying user group role mappings.

Budibase before 3.45.0 fails to properly scope the GET /api/chat-links endpoint by workspace, allowing builders to enumerate chat identity link records across all workspaces in a tenant. Attackers with builder access to a single workspace can retrieve sensitive chat identity linking data including user IDs and external chat service identifiers from other workspaces they have no permission to access.

Budibase versions 3.41.0 before 3.45.0 contain an authentication bypass in the OIDC/SSO login path of @budibase/server. When no existing user matches the incoming SSO subject, the server looks up pending user invites by the IdP-asserted email address alone — without validating an invite code and without an email_verified check. An attacker who can register at an IdP that the tenant trusts for OIDC and assert a victim's invited email address claims the pending invite and inherits all of its granted privileges, including builder and admin.global.

Budibase (@budibase/server) before 3.45.0 builds MySQL and MSSQL column-rename DDL in packages/backend-core/src/sql/sqlTable.ts by interpolating identifiers directly into a raw query string without applying the project's quoteMySqlIdentifier / quoteSqlServerIdentifier helpers. An attacker with DDL rights on a connected MySQL/MSSQL datasource can create a column whose name contains a backtick or single quote plus additional SQL; when a Budibase builder later renames that column through the UI, the injected SQL is executed.

Budibase Server before 3.45.0 contains an arbitrary file write vulnerability in the PWA icon upload endpoint that extracts user-supplied ZIP archives without proper symlink validation. Attackers with BUILDER role can craft a malicious ZIP with leaf symlink entries followed by duplicate file entries to write arbitrary files as root, enabling remote code execution.

Budibase versions before 3.45.0 fail to disable external JSON reference resolution in the OpenAPI/Swagger import validator, allowing authenticated builders to read arbitrary local files. Attackers with builder access can embed file:// references in OpenAPI specifications submitted to the import endpoint to exfiltrate sensitive files including environment variables containing JWT secrets, API keys, and database credentials.

stoatchat before 0.15.5 fails to validate that MFA tickets belong to the authenticated user, allowing attackers to bypass MFA by using their own valid ticket with another user's session token. Attackers can obtain a ticket from their own account and use it with a victim's session token to disable TOTP, view recovery codes, or perform other sensitive operations without providing the victim's credentials.

January, the media proxy/embed service of stoatchat, before version 0.15.5 improperly resolves SVG <image href> values as local filesystem paths when a fetched resource is served as image/svg+xml. An unauthenticated remote attacker who causes the service to proxy an attacker-hosted SVG can determine whether local files exist through observable response-time differences, and can cause supported local image files to be disclosed after re-encoding.

The Grav Data Manager plugin versions 1.0.1 through 1.4.4 render stored data entries in the item-detail view without escaping, applying Twig's `raw` filter. An unauthenticated visitor who submits a front-end form whose submissions are saved to user/data can store an HTML payload that executes as JavaScript in the session and origin of an administrator who later opens that entry in the classic admin panel.

The Comments plugin for Grav CMS through version 1.2.10 registers an admin handler that returns comment data as JSON without any authentication check. The handler branches on isAdmin(), which only indicates that the admin service is registered on the current route rather than that the visitor is authenticated. On a site using the classic Admin plugin with Comments enabled, an unauthenticated remote attacker can request /admin/comments/page:<n> and retrieve every comment from the last 7 days, including each commenter's email address and the absolute server filesystem path of the data file.

Grav is a flat-file CMS. In versions 2.0.19 through 2.0.24 — and in 2.0.0 through 2.0.18 and 1.7.x only where content Twig has been explicitly enabled — page content authored by a user holding only page-write permission is rendered through a Twig sandbox that allowlists get_cookie(), which returns any cookie sent with the current request, including the visitor's session cookie. Grav then stores the finished post-Twig output in a page-content cache keyed only on page identity and the configuration checksum, with no session, user or request dimension.

Grav CMS 2.0.14 through 2.0.24 has a privilege escalation vulnerability in group and account blueprints. Dot-notation keys like `access.admin.super` bypass guards and let an operator with admin.users grant themselves full super-admin.

Grav before 2.0.25 ships web server configuration samples whose access-control deny rules are matched case-sensitively. In web.config (IIS), every deny rule sets ignoreCase="false", allowing bypass by varying case in folder names or file extensions. On case-insensitive NTFS, an unauthenticated remote attacker can access sensitive files like configuration secrets or password hashes.

Netty HttpServerCodec up to 4.2.17.Final and 4.1.137.Final incorrectly pairs responses with requests when HTTP/1.1 pipelining with Expect: 100-continue is used, leading to response splitting and unsafe connection reuse.

Netty from 4.2.11.Final before 4.2.18.Final has an incomplete hostname verification fix in the QUIC certificate path when using a plain X509TrustManager, allowing attackers to present a certificate for the wrong hostname.

Netty's HTTP/3 codec from 4.2.2.Final through 4.2.17.Final builds the :authority pseudo-header from the Host header before considering the authority of an absolute-form request-target, leading to authority confusion.

Netty's HTTP/3 codec from 4.2.2.Final through 4.2.17.Final does not special-case HTTP/1 CONNECT authority-form request-targets, resulting in malformed HTTP/3 CONNECT with attacker-controlled authority.

Netty's HTTP/3 codec from 4.2.0.Final through 4.2.17.Final has an uncontrolled resource consumption vulnerability in the QPACK encoder-stream instruction decoder, allowing an attacker to declare huge literal lengths, causing unbounded heap growth and OutOfMemoryError.

Netty's QPACK prefixed-integer decoder (netty-codec-http3) from 4.2.0.Final through 4.2.17.Final does not bound continuation bytes, allowing an attacker to cause O(N^2) CPU cost and memory growth, leading to OOM and event-loop starvation.