CVE Vulnerability Catalog

FileRun before 2026.3.0 contains an OS command injection vulnerability caused by a no-op redefinition of escapeshellcmd() in CLI.php that strips shell-metacharacter escaping. Attackers can exploit this interactively via image_preview.php with a crafted args parameter (requiring superuser authentication) or persistently by storing malicious payloads in thumbnails_ffmpeg_args or thumbnails_ffmpeg_ss that execute when any user triggers video thumbnail generation.

FileRun before 2026.3.0 contains an OS command injection vulnerability in the PhotoProofSheet handler. An authenticated user with upload permission can execute arbitrary commands by uploading files with shell metacharacters in their names, such as backticks, semicolons, or $() sequences, then triggering the PhotoProofSheet endpoint. This is due to missing escapeshellarg() sanitization in the ImageMagick montage command construction.

Anchor CMS through 0.12.7 fails to enforce role-based access control in admin user-management endpoints. Any authenticated low-privilege user can POST directly to admin/users/add or admin/users/edit to create administrator accounts or change the existing administrator's password.

knowns through 0.33.0 unconditionally exempts the project.set action from permission guard checks. Read-only agent sessions can bypass restrictions by invoking project.set to repoint the server at another project directory and obtain write access capabilities.

knowns through 0.33.0 fails to properly validate template destination paths in the code generation template engine, allowing attackers to read and write arbitrary files outside the project root. Attackers can supply malicious templates that traverse directories to overwrite shell profiles, steal credentials, or achieve persistent code execution on victim systems.

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.64.0 until 1.75.1, the FTP auth-proxy driver in cmd/serve/ftp/ftp.go stores one obscured password per username in the server-wide userPass map[string]string instead of binding the credential or VFS to the authenticated session. If two accepted credentials use the same username but resolve to different proxy backends, a later CheckPasswd login overwrites userPass[user], and subsequent getVFS operations on the first session are reauthorized with the later password. The first session can then read, create, overwrite, rename, or delete objects using the second credential’s backend authority. Exploitation requires the later same-username login to occur while the first session remains open. This issue is fixed in version 1.75.1.

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, when backend/local runs with --links, a source .rclonelink object can plant a symlink in the destination and later directory metadata is applied through that path. MkdirMetadata, writeMetadataToFile, and setTimes operate when Directory.translatedLink=false, so os.Chown, os.Chmod, os.Chtimes, and birth-time handling can bypass os.Root confinement and follow the symlink. An attacker controlling source contents can therefore apply selected ownership, permissions, modification times, or birth times to a file or directory outside the destination, with --metadata required for chmod and chown while modification time is applied by the normal directory workflow. This issue is fixed in version 1.75.1.

Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.56, and from 3.0.0 until 3.7.12, a client-supplied dot-form header such as X.Authenticated.User survives ForwardAuth replacement and underscoreHeadersStrategy because Go treats it as distinct from X-Authenticated-User while normalization-prone CGI, WSGI, PHP, and NGINX backends collapse both names. A backend can consequently consume the client value instead of the identity Traefik asserted, allowing identity spoofing for any header managed by Traefik. The aliasHeadersStrategy protection is disabled by default and must be configured as delete or reject. The mitigation is available in 2.11.56 and 3.7.12.

Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.57, and 3.7.13, Traefik accepts a rootless HTTP/1 request target that Go stores in URL.Opaque while leaving URL.Path empty. The rewriteRequestBuilder path evaluates routing, path sanitization, forwardAuth, encodedCharacters, and access logging against a path normalized to / but forwards URL.Opaque verbatim to the backend, allowing cross-vhost routing bypass, path-scoped authorization bypass, and access-log evasion when the backend interprets the opaque target as a path. This issue is fixed in 2.11.57 and 3.7.13.

A remote, authenticated, non-admin Craft CMS Control Panel user with only the accessCp permission can execute operating system commands as the PHP web worker.

NI SystemLink contains a storage of sensitive information in cleartext vulnerability. An attacker with local access may obtain sensitive information stored by the system in the clear. This affects NI SystemLink and NI SystemLink Server versions prior to 2026 Q3.

An improper access control vulnerability in NI SystemLink may allow an authenticated user with limited privileges to access host operating system files and directories that should be restricted. Affects NI SystemLink and NI SystemLink Server versions prior to 2026 Q3.

A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the link-following chown() function on a pathname inside a user-controlled directory. A local attacker can exploit this via a Time-of-Check Time-of-Use (TOCTOU) race condition and exchange the socket pathname with a symbolic link pointing to an arbitrary root-owned file (such as /etc/pam.d/su). The daemon subsequently follows the symlink and changes the ownership of the targeted root-owned file to the attacker's user ID. This allows an authenticated local attacker to modify critical system files, leading to a full local privilege escalation to root.

Traefik is an open source HTTP reverse proxy and load balancer. From 3.2.0 until 3.7.13, Traefik entrypoint defenses aliasHeadersStrategy, underscoreHeadersStrategy, and forwardedHeaders inspect req.Header but not req.Trailer, allowing an unauthenticated client to submit an aliasing or trusted header name in an HTTP/1.1 chunked trailer or an HTTP/2 trailer. When the retry or buffering middleware reads the body before the reverse proxy clones the request, the attacker-controlled trailer value reaches a backend that merges trailers into the header namespace, bypassing the documented delete or reject behavior and potentially spoofing identity or forwarded routing data. This issue is fixed in 3.7.13.

The WP Fast Total Search WordPress plugin in versions up to 1.82.284 contains a Broken Access Control vulnerability. An unauthenticated attacker can bypass access control mechanisms.

The WPAdverts WordPress plugin in versions up to 2.3.3 contains a Cross Site Scripting (XSS) vulnerability. An unauthenticated attacker can inject a malicious script.

The WPCS WordPress plugin in versions up to 1.3.2 contains a Cross Site Scripting (XSS) vulnerability. An unauthenticated attacker can inject a malicious script.

The SiteSkite plugin in versions up to 2.1.5 contains a Privilege Escalation vulnerability. An unauthenticated attacker can elevate their privileges.

The ZHBackup – Backup, Restore & Migration plugin in versions up to 2.4.2 contains a Sensitive Data Exposure vulnerability. An unauthenticated attacker can access sensitive data.

The RepairBuddy plugin in versions up to 4.1224 contains a Remote Code Execution (RCE) vulnerability. An attacker with subscriber privileges can execute code remotely.