Skip to content

Commit c510615

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-29r8-gvx4-r9w3 GHSA-8p2x-5cpm-qrqw GHSA-9ffq-6457-8958 GHSA-fh48-f69w-7vmp GHSA-fr76-5637-w3g9 GHSA-ghx5-7jjg-q2j7 GHSA-j36m-74g2-7m95 GHSA-m59h-42jf-cphr GHSA-m99f-mmvg-3xmx GHSA-pwjx-qhcg-rvj4 GHSA-wxjx-r2j2-96fx
1 parent b20f5df commit c510615

11 files changed

Lines changed: 553 additions & 19 deletions

File tree

‎advisories/github-reviewed/2026/03/GHSA-29r8-gvx4-r9w3/GHSA-29r8-gvx4-r9w3.json‎

Lines changed: 16 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-29r8-gvx4-r9w3",
4-
"modified": "2026-03-18T16:17:26Z",
4+
"modified": "2026-03-25T19:53:20Z",
55
"published": "2026-03-17T09:31:28Z",
66
"aliases": [
77
"CVE-2026-4208"
@@ -28,14 +28,11 @@
2828
"introduced": "0"
2929
},
3030
{
31-
"fixed": "2.0.1"
31+
"fixed": "1.0.7"
3232
}
3333
]
3434
}
35-
],
36-
"database_specific": {
37-
"last_known_affected_version_range": "<= 2.0.0"
38-
}
35+
]
3936
},
4037
{
4138
"package": {
@@ -47,17 +44,17 @@
4744
"type": "ECOSYSTEM",
4845
"events": [
4946
{
50-
"introduced": "0"
47+
"introduced": "2.0.0"
5148
},
5249
{
53-
"fixed": "1.0.7"
50+
"fixed": "2.0.1"
5451
}
5552
]
5653
}
5754
],
58-
"database_specific": {
59-
"last_known_affected_version_range": "<= 1.0.5"
60-
}
55+
"versions": [
56+
"2.0.0"
57+
]
6158
}
6259
],
6360
"references": [
@@ -73,6 +70,14 @@
7370
"type": "PACKAGE",
7471
"url": "https://github.com/MrSilaz/mfa_email"
7572
},
73+
{
74+
"type": "WEB",
75+
"url": "https://github.com/MrSilaz/mfa_email/releases/tag/v1.0.7"
76+
},
77+
{
78+
"type": "WEB",
79+
"url": "https://github.com/MrSilaz/mfa_email/releases/tag/v2.0.1"
80+
},
7681
{
7782
"type": "WEB",
7883
"url": "https://typo3.org/security/advisory/typo3-ext-sa-2026-007"

‎advisories/github-reviewed/2026/03/GHSA-8p2x-5cpm-qrqw/GHSA-8p2x-5cpm-qrqw.json‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-8p2x-5cpm-qrqw",
4+
"modified": "2026-03-25T19:54:42Z",
5+
"published": "2026-03-25T19:54:42Z",
6+
"aliases": [
7+
"CVE-2026-33690"
8+
],
9+
"summary": "AVideo vulnerable to IP Address Spoofing via Untrusted HTTP Headers in getRealIpAddr()",
10+
"details": "## Summary\n\nThe `getRealIpAddr()` function in `objects/functions.php` trusts user-controlled HTTP headers to determine the client's IP address. \nAn attacker can spoof their IP address by sending forged headers, bypassing any IP-based access controls or audit logging.\n\n## Vulnerable Code\n\nFile: `objects/functions.php`\n```php\n$headers = [\n 'HTTP_X_REAL_IP', \n 'HTTP_CLIENT_IP', \n 'HTTP_X_FORWARDED_FOR',\n 'REMOTE_ADDR'\n];\n\nforeach ($headers as $header) {\n if (!empty($_SERVER[$header])) {\n $ips = explode(',', $_SERVER[$header]);\n foreach ($ips as $ipCandidate) {\n $ipCandidate = trim($ipCandidate);\n if (filter_var($ipCandidate, FILTER_VALIDATE_IP, \n FILTER_FLAG_IPV4)) {\n return $ipCandidate; \n }\n }\n }\n}\n```\n\n## Attack Scenario\n\n1. Attacker sends request with forged header:\n```\nX-Client-IP: 127.0.0.1\n```\nor\n```\nX-Real-IP: 192.168.1.1\n```\n\n2. `getRealIpAddr()` returns the forged IP\n3. Any IP-based rate limiting, access control, or audit \n log that relies on this function is bypassed\n\n## Proof of Concept\n```bash\ncurl -H \"X-Client-IP: 127.0.0.1\" \\\n https://target.com/any_endpoint.php\n```\n\nThe server now believes the request came from localhost.\n\n## Impact\n- Bypass IP-based rate limiting\n- Bypass IP-based access controls\n- Forge audit log entries\n- Potential privilege escalation if localhost is trusted",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Packagist",
21+
"name": "wwbn/avideo"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"last_affected": "26.0"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-8p2x-5cpm-qrqw"
42+
},
43+
{
44+
"type": "ADVISORY",
45+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33690"
46+
},
47+
{
48+
"type": "WEB",
49+
"url": "https://github.com/WWBN/AVideo/commit/1a1df6a9377e5cc67d1d0ac8ef571f7abbffbc6c"
50+
},
51+
{
52+
"type": "PACKAGE",
53+
"url": "https://github.com/WWBN/AVideo"
54+
}
55+
],
56+
"database_specific": {
57+
"cwe_ids": [
58+
"CWE-348"
59+
],
60+
"severity": "MODERATE",
61+
"github_reviewed": true,
62+
"github_reviewed_at": "2026-03-25T19:54:42Z",
63+
"nvd_published_at": "2026-03-23T19:16:42Z"
64+
}
65+
}

‎advisories/github-reviewed/2026/03/GHSA-9ffq-6457-8958/GHSA-9ffq-6457-8958.json‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-9ffq-6457-8958",
4+
"modified": "2026-03-25T20:01:04Z",
5+
"published": "2026-03-25T20:01:04Z",
6+
"aliases": [
7+
"CVE-2026-33686"
8+
],
9+
"summary": "Sharp is Vulnerable to Path Traversal via Unsanitized Extension in FileUtil",
10+
"details": "### Summary\nA path traversal vulnerability exists in the FileUtil class of the code16/sharp package. The application fails to sanitize file extensions properly, allowing path separators to be passed into the storage layer.\n\n### Detail\nIn `src/Utils/FileUtil.php`, the `FileUtil::explodeExtension()` function extracts a file's extension by splitting the filename at the last dot. However, the extracted extension is never sanitized. While the application uses a `normalizeName()` function, this function only cleans the base filename, meaning any path separators (such as /) injected into the extension will survive and be passed into the `storeAs()` function.\n\n### Impact\nExploiting this flaw allows an authenticated attacker to manipulate file paths:\n- Files can be written outside of the intended tmp directory via path traversal. For more details on the package, visit: https://github.com/code16/sharp\n- Existing critical files (such as .env or configuration files) could potentially be overwritten. Review the CWE definition here: https://cwe.mitre.org/data/definitions/22.html (Note: This vulnerability was successfully chained with CWE-434 in a local Proof of Concept to confirm the traversal.)\n\n### Patches\nThis issue has been patched by properly sanitizing the extension using `pathinfo(PATHINFO_EXTENSION)` instead of `strrpos()`, alongside applying strict regex replacements to both the base name and the extension. The fix is available in pull request #715\n\n### Credits\nReported by [zaurgsynv](https://github.com/zaurgsynv).",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Packagist",
21+
"name": "code16/sharp"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "9.20.0"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/code16/sharp/security/advisories/GHSA-9ffq-6457-8958"
42+
},
43+
{
44+
"type": "WEB",
45+
"url": "https://github.com/code16/sharp/pull/715"
46+
},
47+
{
48+
"type": "PACKAGE",
49+
"url": "https://github.com/code16/sharp"
50+
}
51+
],
52+
"database_specific": {
53+
"cwe_ids": [
54+
"CWE-22"
55+
],
56+
"severity": "HIGH",
57+
"github_reviewed": true,
58+
"github_reviewed_at": "2026-03-25T20:01:04Z",
59+
"nvd_published_at": null
60+
}
61+
}

‎advisories/github-reviewed/2026/03/GHSA-fh48-f69w-7vmp/GHSA-fh48-f69w-7vmp.json‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-fh48-f69w-7vmp",
4+
"modified": "2026-03-25T19:56:00Z",
5+
"published": "2026-03-25T19:56:00Z",
6+
"aliases": [
7+
"CVE-2026-33517"
8+
],
9+
"summary": "MantisBT Vulnerable to Stored HTML Injection in Tag Delete Confirmation",
10+
"details": "Improper escaping of Tag name when deleting it in tag_delete.php allows an attacker to inject HTML and, if CSP settings permit, achieve execution of arbitrary JavaScript.\n\n### Impact\nCross-site scripting (XSS).\n\n### Patches\n80990f43153167c73f11eb4b2bc7108d0c3d6b46\n\n### Workarounds\n* Revert commit d6890320752ecf37bd74d11fe14fe7dc12335be9\n* Manually edit language files to remove the sprintf placeholder `%1$s` from *$s_tag_delete_message* string, for example with `sed -r -i '/tag_delete_message/s/.%1\\$s.//' -- lang/`\n\n### Credits\nMantisBT hanks Vishal Shukla for discovering and responsibly reporting the issue.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Packagist",
21+
"name": "mantisbt/mantisbt"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "2.28.0"
29+
},
30+
{
31+
"fixed": "2.28.1"
32+
}
33+
]
34+
}
35+
],
36+
"versions": [
37+
"2.28.0"
38+
]
39+
}
40+
],
41+
"references": [
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/mantisbt/mantisbt/security/advisories/GHSA-fh48-f69w-7vmp"
45+
},
46+
{
47+
"type": "ADVISORY",
48+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33517"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://github.com/mantisbt/mantisbt/commit/80990f43153167c73f11eb4b2bc7108d0c3d6b46"
53+
},
54+
{
55+
"type": "WEB",
56+
"url": "https://github.com/mantisbt/mantisbt/commit/d6890320752ecf37bd74d11fe14fe7dc12335be9"
57+
},
58+
{
59+
"type": "PACKAGE",
60+
"url": "https://github.com/mantisbt/mantisbt"
61+
},
62+
{
63+
"type": "WEB",
64+
"url": "https://mantisbt.org/bugs/view.php?id=36971"
65+
}
66+
],
67+
"database_specific": {
68+
"cwe_ids": [
69+
"CWE-79"
70+
],
71+
"severity": "HIGH",
72+
"github_reviewed": true,
73+
"github_reviewed_at": "2026-03-25T19:56:00Z",
74+
"nvd_published_at": "2026-03-23T20:16:27Z"
75+
}
76+
}

‎advisories/github-reviewed/2026/03/GHSA-fr76-5637-w3g9/GHSA-fr76-5637-w3g9.json‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-fr76-5637-w3g9",
4+
"modified": "2026-03-25T20:00:24Z",
5+
"published": "2026-03-25T20:00:24Z",
6+
"aliases": [
7+
"CVE-2026-33687"
8+
],
9+
"summary": "Sharp has Unrestricted File Upload via Client-Controlled Validation Rules",
10+
"details": "### Summary \nThe `code16/sharp` Laravel admin panel package contains a vulnerability in its file upload endpoint that allows authenticated users to bypass all file type restrictions.\n\n### Details\nThe upload endpoint within the `ApiFormUploadController` accepts a client-controlled `validation_rule` parameter. This parameter is directly passed into the Laravel validator without sufficient server-side enforcement. By intercepting the request and sending `validation_rule[]=file`, an attacker can completely bypass all MIME type and file extension restrictions. The vulnerable code is located in `src/Http/Controllers/Api/ApiFormUploadController.php` at line 24.\n\n### Impact\nThis vulnerability leads to several critical security risks:\n\nAttackers can upload arbitrary files, including PHP webshells, to the server. For more details on the package, visit: https://github.com/code16/sharp\n\nMIME type and extension validation can be bypassed entirely via client-controlled rules. Review the CWE definition here: https://cwe.mitre.org/data/definitions/434.html\n\nIf the storage disk is configured to be publicly accessible, this can lead to Remote Code Execution (RCE). See the vendor repository: https://github.com/code16/sharp\n\n(Note: Under default configurations, executing uploaded PHP files directly is not possible unless a public disk configuration is in place.)\n\n### Patches\nThis issue has been addressed by removing the client-controlled validation rules and strictly defining upload rules server-side. The fix is available in pull request https://github.com/code16/sharp/pull/714.\n\n### Workarounds\n- Restrict Disk Access: Ensure that the storage disk used for Sharp uploads is strictly private. Under default configurations, an attacker cannot directly execute uploaded PHP files unless a public disk configuration is explicitly used. For more details on Laravel disk configurations, visit: https://laravel.com/docs/13.x/filesystem\n\n### Credits\nReported by [zaurgsynv](https://github.com/zaurgsynv).",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Packagist",
21+
"name": "code16/sharp"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "9.20.0"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/code16/sharp/security/advisories/GHSA-fr76-5637-w3g9"
42+
},
43+
{
44+
"type": "WEB",
45+
"url": "https://github.com/code16/sharp/pull/714"
46+
},
47+
{
48+
"type": "PACKAGE",
49+
"url": "https://github.com/code16/sharp"
50+
},
51+
{
52+
"type": "WEB",
53+
"url": "https://github.com/code16/sharp/releases/tag/v9.20.0"
54+
},
55+
{
56+
"type": "WEB",
57+
"url": "https://laravel.com/docs/13.x/filesystem"
58+
}
59+
],
60+
"database_specific": {
61+
"cwe_ids": [
62+
"CWE-434"
63+
],
64+
"severity": "HIGH",
65+
"github_reviewed": true,
66+
"github_reviewed_at": "2026-03-25T20:00:24Z",
67+
"nvd_published_at": null
68+
}
69+
}

0 commit comments

Comments
 (0)