Skip to content

Commit c0f297d

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-mmpx-jh39-wrv6 GHSA-55jc-jj35-fw6c GHSA-23v5-vgf6-5452 GHSA-2jfv-r29r-j6wr GHSA-62w9-2w47-xvhj GHSA-7cv5-2ch3-g323 GHSA-94jg-w625-jq92 GHSA-h9h9-phrr-4q27 GHSA-rprm-6mg6-r8fm GHSA-w3xc-h2ch-2q3q GHSA-wg4g-3863-r8m4 GHSA-x96p-55v7-jmrq
1 parent 2c19619 commit c0f297d

12 files changed

Lines changed: 402 additions & 12 deletions

File tree

‎advisories/github-reviewed/2026/05/GHSA-mmpx-jh39-wrv6/GHSA-mmpx-jh39-wrv6.json‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-mmpx-jh39-wrv6",
4+
"modified": "2026-05-07T03:29:43Z",
5+
"published": "2026-05-07T03:29:43Z",
6+
"aliases": [],
7+
"summary": "FileBrowser Vulnerable to Stored XSS via SVG File in Public Share (Missing CSP Header)",
8+
"details": "## Summary\n\nFileBrowser Quantum serves inline SVG files without a `Content-Security-Policy` header, allowing embedded JavaScript in SVG files to execute when accessed via public share links.\n\nVerified on v1.3.0-stable.\n\n## Affected product\n\n- **Product:** FileBrowser Quantum (`gtsteffaniak/filebrowser`)\n- **Verified version:** v1.3.0-stable\n- **Docker image:** gtstef/filebrowser:latest\n- **Affected endpoint:** `GET /public/api/resources/download?hash=HASH&inline=true`\n- **CWE:** CWE-79 — Cross-site Scripting (Stored)\n\n## Impact\n\n- **Stored XSS** — Malicious SVG persists and executes for every visitor to the share link\n- **No authentication required to trigger** — Public share links are accessible to anyone\n- **Session hijacking** — If authenticated users click the link, their session can be stolen\n- **Phishing** — Attacker can redirect or overlay fake login forms\n\n## Reproduction\n\n1. Login as any user with upload permission\n2. Upload SVG file:\n ```xml\n <svg xmlns=\"http://www.w3.org/2000/svg\">\n <script>alert(document.domain)</script>\n </svg>\n ```\n3. Create public share for the file\n4. Access the share link with `?inline=true`\n5. JavaScript executes in browser\n\n## Root cause\n\nThe inline download endpoint returns SVG files with:\n```\nContent-Type: image/svg+xml\nContent-Disposition: inline; filename=\"xss.svg\"\nX-Content-Type-Options: nosniff\n```\n\nBut no CSP header to block script execution. The upstream project (filebrowser/filebrowser) mitigates this with:\n```\nContent-Security-Policy: script-src 'none'\n```\n\n## Suggested fix\n\nAdd CSP header on inline file downloads:\n\n```go\nw.Header().Set(\"Content-Security-Policy\", \"script-src 'none'\")\n```\n\nThis matches the upstream filebrowser/filebrowser implementation.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V3",
12+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "Go",
19+
"name": "github.com/gtsteffaniak/filebrowser"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
},
28+
{
29+
"fixed": "0.0.0-20260501184955-6bfc3974192e"
30+
}
31+
]
32+
}
33+
]
34+
}
35+
],
36+
"references": [
37+
{
38+
"type": "WEB",
39+
"url": "https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-mmpx-jh39-wrv6"
40+
},
41+
{
42+
"type": "WEB",
43+
"url": "https://github.com/gtsteffaniak/filebrowser/commit/6bfc3974192e954f71cc5d1cd04baaaec3b76383"
44+
},
45+
{
46+
"type": "PACKAGE",
47+
"url": "https://github.com/gtsteffaniak/filebrowser"
48+
}
49+
],
50+
"database_specific": {
51+
"cwe_ids": [
52+
"CWE-79"
53+
],
54+
"severity": "MODERATE",
55+
"github_reviewed": true,
56+
"github_reviewed_at": "2026-05-07T03:29:43Z",
57+
"nvd_published_at": null
58+
}
59+
}

‎advisories/unreviewed/2026/04/GHSA-55jc-jj35-fw6c/GHSA-55jc-jj35-fw6c.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,17 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-55jc-jj35-fw6c",
4-
"modified": "2026-04-27T15:30:52Z",
4+
"modified": "2026-05-07T03:31:19Z",
55
"published": "2026-04-27T15:30:52Z",
66
"aliases": [
77
"CVE-2026-6265"
88
],
99
"details": "Insecure preserved inherited permissions vulnerability in Cerberus FTP Server on Windows allows Privilege Escalation.This issue has been resolved in Cerberus FTP Server: 2026.1",
1010
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
},
1115
{
1216
"type": "CVSS_V4",
1317
"score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"

‎advisories/unreviewed/2026/05/GHSA-23v5-vgf6-5452/GHSA-23v5-vgf6-5452.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-23v5-vgf6-5452",
4-
"modified": "2026-05-01T15:30:35Z",
4+
"modified": "2026-05-07T03:31:20Z",
55
"published": "2026-05-01T15:30:35Z",
66
"aliases": [
77
"CVE-2026-31776"
88
],
99
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: ctxfi: Fix missing SPDIFI1 index handling\n\nSPDIF1 DAIO type isn't properly handled in daio_device_index() for\nhw20k2, and it returned -EINVAL, which ended up with the out-of-bounds\narray access. Follow the hw20k1 pattern and return the proper index\nfor this type, too.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -48,8 +53,10 @@
4853
}
4954
],
5055
"database_specific": {
51-
"cwe_ids": [],
52-
"severity": null,
56+
"cwe_ids": [
57+
"CWE-129"
58+
],
59+
"severity": "HIGH",
5360
"github_reviewed": false,
5461
"github_reviewed_at": null,
5562
"nvd_published_at": "2026-05-01T15:16:40Z"

‎advisories/unreviewed/2026/05/GHSA-2jfv-r29r-j6wr/GHSA-2jfv-r29r-j6wr.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2jfv-r29r-j6wr",
4+
"modified": "2026-05-07T03:31:21Z",
5+
"published": "2026-05-07T03:31:21Z",
6+
"aliases": [
7+
"CVE-2026-40003"
8+
],
9+
"details": "ZTE ZX297520V3 BootROM contains a vulnerability that allows arbitrary memory writes via USB. Attackers can exploit the lack of target address validation in the USB download mode to write data to any location in BootROM runtime memory, thereby overwriting the stack, hijacking the execution flow, bypassing the Secure Boot signature verification mechanism, and achieving unauthorized code execution.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40003"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/2144487415169560645"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-787"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-05-07T02:16:03Z"
35+
}
36+
}

‎advisories/unreviewed/2026/05/GHSA-62w9-2w47-xvhj/GHSA-62w9-2w47-xvhj.json‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-62w9-2w47-xvhj",
4+
"modified": "2026-05-07T03:31:21Z",
5+
"published": "2026-05-07T03:31:21Z",
6+
"aliases": [
7+
"CVE-2026-6222"
8+
],
9+
"details": "The Forminator Forms plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.51.1. This is due to the `processRequest()` method in `Forminator_Admin_Module_Edit_Page` (admin/abstracts/class-admin-module-edit-page.php) dispatching sensitive module-management actions — including export, delete, clone, delete-entries, publish/draft, and bulk variants — after only a nonce check, without ever verifying that the current user holds the `manage_forminator_modules` capability. The nonce used (`forminator_form_request`) is unconditionally embedded in the global `forminatorData` JavaScript object and localized on every Forminator admin page, including Templates and Reports pages accessible to users who explicitly lack module-management permissions. Because `processRequest()` is invoked during the `admin_menu` action hook — which fires before WordPress enforces page-level capability checks — a user whose Forminator role is restricted to Templates or Reports can craft a valid POST request targeting any published module and successfully trigger the vulnerable actions. This makes it possible for authenticated attackers with subscriber-level access (or any custom low-privilege Forminator role) to export the complete internal configuration of arbitrary forms/polls/quizzes (including notification routing, integration credentials, and conditional logic), delete modules, delete all submissions/votes, clone modules, or bulk-change publish/draft status.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6222"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/browser/forminator/tags/1.51.1/admin/abstracts/class-admin-module-edit-page.php#L1008"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://plugins.trac.wordpress.org/browser/forminator/tags/1.51.1/admin/abstracts/class-admin-module-edit-page.php#L951"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://plugins.trac.wordpress.org/browser/forminator/tags/1.51.1/admin/classes/class-admin-data.php#L141"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://plugins.trac.wordpress.org/browser/forminator/tags/1.52/admin/abstracts/class-admin-module-edit-page.php#L988"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://plugins.trac.wordpress.org/browser/forminator/trunk/admin/abstracts/class-admin-module-edit-page.php#L1008"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://plugins.trac.wordpress.org/browser/forminator/trunk/admin/abstracts/class-admin-module-edit-page.php#L951"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://plugins.trac.wordpress.org/browser/forminator/trunk/admin/classes/class-admin-data.php#L141"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e860aa70-b8ef-4b2a-a035-b01efce30a79?source=cve"
53+
}
54+
],
55+
"database_specific": {
56+
"cwe_ids": [
57+
"CWE-862"
58+
],
59+
"severity": "MODERATE",
60+
"github_reviewed": false,
61+
"github_reviewed_at": null,
62+
"nvd_published_at": "2026-05-07T02:16:37Z"
63+
}
64+
}

‎advisories/unreviewed/2026/05/GHSA-7cv5-2ch3-g323/GHSA-7cv5-2ch3-g323.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-7cv5-2ch3-g323",
4+
"modified": "2026-05-07T03:31:21Z",
5+
"published": "2026-05-07T03:31:21Z",
6+
"aliases": [
7+
"CVE-2026-44600"
8+
],
9+
"details": "Tor before 0.4.9.7 mishandles accounting of the conflux out-of-order queue during the clearing of a queue.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44600"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://forum.torproject.org/c/news/tor-release-announcement/28"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://gitlab.torproject.org/tpo/core/tor/-/commit/a198185ed863677d60eec120126730628dac35bb"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://gitlab.torproject.org/tpo/core/tor/-/work_items/41251"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.openwall.com/lists/oss-security/2026/05/06/8"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-696"
42+
],
43+
"severity": "LOW",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2026-05-07T03:16:08Z"
47+
}
48+
}

‎advisories/unreviewed/2026/05/GHSA-94jg-w625-jq92/GHSA-94jg-w625-jq92.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-94jg-w625-jq92",
4+
"modified": "2026-05-07T03:31:21Z",
5+
"published": "2026-05-07T03:31:21Z",
6+
"aliases": [
7+
"CVE-2026-44597"
8+
],
9+
"details": "Tor before 0.4.9.7 has an out-of-bounds read when an END, a TRUNCATE, or a TRUNCATED cell lacks a reason in its payload, aka TROVE-2026-011.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44597"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://forum.torproject.org/c/news/tor-release-announcement/28"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://gitlab.torproject.org/tpo/core/tor/-/commit/8f98054b1982d00a14639864d03e9afd90b87481"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://gitlab.torproject.org/tpo/core/tor/-/work_items/41254"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.openwall.com/lists/oss-security/2026/05/06/8"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-684"
42+
],
43+
"severity": "LOW",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2026-05-07T01:16:01Z"
47+
}
48+
}

‎advisories/unreviewed/2026/05/GHSA-h9h9-phrr-4q27/GHSA-h9h9-phrr-4q27.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-h9h9-phrr-4q27",
4-
"modified": "2026-05-01T15:30:35Z",
4+
"modified": "2026-05-07T03:31:20Z",
55
"published": "2026-05-01T15:30:35Z",
66
"aliases": [
77
"CVE-2026-31775"
88
],
99
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: ctxfi: Don't enumerate SPDIF1 at DAIO initialization\n\nThe recent refactoring of xfi driver changed the assignment of\natc->daios[] at atc_get_resources(); now it loops over all enum\nDAIOTYP entries while it looped formerly only a part of them.\nThe problem is that the last entry, SPDIF1, is a special type that\nis used only for hw20k1 CTSB073X model (as a replacement of SPDIFIO),\nand there is no corresponding definition for hw20k2. Due to the lack\nof the info, it caused a kernel crash on hw20k2, which was already\nworked around by the commit b045ab3dff97 (\"ALSA: ctxfi: Fix missing\nSPDIFI1 index handling\").\n\nThis patch addresses the root cause of the regression above properly,\nsimply by skipping the incorrect SPDIF1 type in the parser loop.\n\nFor making the change clearer, the code is slightly arranged, too.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -25,7 +30,7 @@
2530
],
2631
"database_specific": {
2732
"cwe_ids": [],
28-
"severity": null,
33+
"severity": "MODERATE",
2934
"github_reviewed": false,
3035
"github_reviewed_at": null,
3136
"nvd_published_at": "2026-05-01T15:16:40Z"

‎advisories/unreviewed/2026/05/GHSA-rprm-6mg6-r8fm/GHSA-rprm-6mg6-r8fm.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-rprm-6mg6-r8fm",
4+
"modified": "2026-05-07T03:31:21Z",
5+
"published": "2026-05-07T03:31:21Z",
6+
"aliases": [
7+
"CVE-2026-44599"
8+
],
9+
"details": "Tor before 0.4.9.7 can attempt or accept BEGIN_DIR via conflux legs, aka TROVE-2026-008.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44599"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://forum.torproject.org/c/news/tor-release-announcement/28"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://gitlab.torproject.org/tpo/core/tor/-/commit/50f90ba849088247734786922855c22661c6fa03"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://gitlab.torproject.org/tpo/core/tor/-/work_items/41243"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.openwall.com/lists/oss-security/2026/05/06/8"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-669"
42+
],
43+
"severity": "LOW",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2026-05-07T03:16:07Z"
47+
}
48+
}

0 commit comments

Comments
 (0)