New vulnerabilities – clearly explained

Research and translation in progress – available shortly.

DB-GPT: Directory traversal in example file handling

DB-GPT versions 0.7.5 and 0.8.0 contain a directory traversal flaw in the use_example_file function of the examples API. The target path is built from the example name without validation, so a name containing traversal sequences can cause files to be written outside the user upload directory. The reporter describes arbitrary file writes that could lead to configuration tampering or code execution, which is not verified. Exploitation depends on the example name being manipulated, for example through configuration or database changes, and the reporter says authenticated access is needed, which conflicts with the CVSS vector.

eosphoros-ai · DB-GPT

Agent Zero: Directory traversal in file browser save_text_file

Agent Zero versions 1.7 to 1.10 do not validate user-supplied file paths in the File Browser method save_text_file. An attacker who can reach the web interface can write files to arbitrary locations on the host, which can overwrite system or configuration files or plant executables. The CVE record rates this as High (CVSS 7.5) with no authentication required, but the vector is inconsistent with the method's write function and should be verified in the NVD record.

agent0ai · Agent Zero

Botan: Integer overflow in FFI block size reporting can cause memory corruption

The Botan cryptography library reports the block size of a block cipher through its C API without checking for overflow when converting to int. An application that accepts external algorithm parameter strings and uses the FFI raw ECB mode can be tricked by an attacker into selecting the variable-block-size Lion cipher, leading to truncated size reporting, insufficient buffer allocation and memory corruption. The C++ API and commonly used C API modes such as CBC and CTR are not affected.

Botan Project · Botan

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Nomad: Symlink following allows writes outside the allocation directory

HashiCorp Nomad and Nomad Enterprise follow symbolic links when writing dispatch payloads and executor logs. A user with job submission rights can use a malicious workload to create, overwrite or append to files outside the allocation directory. If the Nomad client agent runs as root, this can lead to code execution as root on the client host.

HashiCorp · Nomad

Research and translation in progress – available shortly.

SD JWT JS: Tampered disclosures silently dropped instead of rejected

SD JWT JS (@sd-jwt/core and @sd-jwt/decode) up to version 0.19.0 does not reject an SD-JWT presentation when a Disclosure has been tampered with or is malformed. The library silently drops the affected Disclosure and returns a reduced claim set without an error, although the Issuer signature remains valid. A malicious holder can thereby omit claims, and an on-path attacker can do the same if the relying party does not enforce key binding. If a verifier defaults to allowing access when a claim such as age or role is absent, this can change an authorization decision.

OpenWallet Foundation · SD JWT JS (@sd-jwt/core)

Centreon Web: Authenticated SQL injection in ACL management

Centreon Web, an open-source IT monitoring platform, contains an SQL injection flaw in its ACL management (Resources & Actions). An authenticated user with ACL management rights can read and modify the Centreon database. The attacker needs high privileges, so the main risk is a malicious or compromised administrator. The database stores monitoring configuration and credentials for monitored systems.

Centreon · Centreon Web

AWS Private CA Connector for Kubernetes: Incorrect authorization in issuer resolution

The issuer resolution logic in the AWS Private CA Connector for Kubernetes (aws-privateca-issuer) before v1.10.1 does not correctly enforce authorization. An authenticated user whose approval policy only permits a namespace-scoped issuer may obtain certificates, including subordinate CA certificates, signed by a cluster-scoped AWS Private CA issuer they are not authorized to use. The attack requires valid cluster credentials and low privileges.

Amazon Web Services · AWS Private CA Connector for Kubernetes

Botan: Insufficiently seeded random number generator in AutoSeeded_RNG

Botan is a C++ cryptography library. In versions 3.7.0 up to 3.13.0, AutoSeeded_RNG can mark itself as seeded without consulting the configured entropy source if an application clears the generator and then requests empty output while it is unseeded. On builds without a system RNG, later non-empty requests can then produce output from predictable state, which may weaken keys, nonces or tokens. The attack vector is local with low privileges, and exploitation is not known.

randombit · Botan

minimatch: Denial of service via amplification of glob parts

The npm package minimatch, which converts glob patterns into JavaScript RegExp objects, can be driven into excessive CPU and memory consumption during pattern compilation. A short, attacker-controlled glob pattern containing **/.. segments triggers repeated expansion at optimizationLevel 2 or higher. The impact is limited to availability, so a vulnerable application may become slow or crash.

isaacs · minimatch

Sigstore @sigstore/oci: Credential leak to cross-host blob upload location

The @sigstore/oci library of sigstore-js sends registry Authorization headers, Docker configuration headers or Basic credentials to an upload location supplied by the registry, without checking that it matches the registry's origin. A malicious or compromised registry can redirect a user pushing an artifact via attachArtifactToImage() to an attacker-controlled host and obtain the bearer token or credentials. The attack requires the victim to push an artifact and a malicious or compromised registry; the impact is limited to confidentiality.

Sigstore · sigstore-js (@sigstore/oci)

Monkeytype CI workflow: code execution with elevated token via fork pull request

The format-fixing GitHub Actions workflow of the Monkeytype repository runs on pull_request_target with write permissions and executes code from a fork pull request. An external contributor whose pull request receives the format label can run arbitrary code, read the GITHUB_TOKEN and push repository content or modify pull requests and issues. The typing test application and user data are not affected.

monkeytypegame · Monkeytype

Kubeflow Pipelines: Denial of service via decompression bomb in pipeline upload

Kubeflow Pipelines API server versions before 2.18.0 decompress uploaded pipeline archives without sufficiently bounding the expanded size. A small, specially crafted ZIP or gzip-compressed tar archive can consume large amounts of memory and exhaust API server resources. Because decompression happens before namespace authorization, any caller that can reach the upload endpoint can trigger it without valid credentials.

Kubeflow · Kubeflow Pipelines

Research and translation in progress – available shortly.

Kubeflow Pipelines: Missing authorization in run log endpoint

Kubeflow Pipelines before 2.18.0 does not check whether the caller may access a run before returning its pod logs through the API server's run log endpoint. An attacker who can reach the API server and knows a run ID and a suitable pod or node identifier can read live or archived logs with the API server's permissions. Because the live log path also accepts the node ID as a pod name without verifying the run, a known run ID can be used to read logs of an unrelated pod in another namespace. Exposed logs may contain sensitive workload data or credentials.

Kubeflow · Pipelines

Kubeflow Pipelines: Path traversal leading to arbitrary file read via volume artifact source

Kubeflow Pipelines before 2.18.0 does not restrict the file path supplied to the GET /artifacts/get?source=volume route to the selected volume. An attacker who can reach this route and knows the name of an existing mounted volume can read files outside that volume, as far as the artifact-serving process has read access. With authentication disabled, no credentials are required; in multi-user deployments the caller normally must be authorized for the requested namespace. The impact is limited to confidentiality.

Kubeflow · Pipelines

Rapid7 Insight Agent: Local privilege escalation via crafted path

Rapid7 Insight Agent on Linux and macOS does not handle local filesystem paths correctly. An authenticated local user with low privileges can gain elevated privileges when the agent's inventory collection processes a crafted path. Exploitation requires an existing local account and is not network-reachable.

Rapid7 · Insight Agent

Tailscale Android: Missing caller authentication in IPN broadcast receiver

Tailscale Android build versionCode 297862600 exports a broadcast receiver without a permission or caller check. A locally installed app with no permissions can send a broadcast that changes the VPN exit-node setting, the allow-LAN-access setting, or the connect/disconnect state of the VPN. The exit node must already exist in the victim's netmap, and the connect action may require the system VPN consent on a fresh profile. The CVE record itself describes the issue only as insecure permissions, and the CVSS 9.1 score and CWE-732 are from NVD and could not be confirmed on NVD at the time of research.

Tailscale · Android app

Nextcloud Android: Exported activity allows forced login to attacker server

The Nextcloud Android app (com.nextcloud.client) contains an exported activity without permission protection. A malicious app installed on the same phone, holding no permissions, can send a crafted login deep link that creates an account and sets it as current, so the victim app switches to an attacker-controlled server profile. The attacker must control the server named in the link, and no user interaction is needed. The NVD record and its network-based CVSS vector are unconfirmed, and the third-party advisory describes a local attack, so the severity rating is disputed.

Nextcloud · Android client

Shelter: Improper authentication in exported activity allows auth_key registration

Shelter versionCode 445 (F-Droid version 1.9.1) exports an activity that accepts intents from any app without a permission. According to a third-party advisory, a local app with no permissions can register its own auth_key on a Shelter instance that was never enrolled and then use the app's binder service and change its preference state. Once a key is enrolled, the stored key is required, so the main risk is during first setup. The NVD score of 9.8 assumes network access, which the advisory does not confirm, so this should be treated as a risk from other apps on the same device.

PeterCxy · Shelter