CVE Vulnerability Catalog

FileRise is a self-hosted web-based file manager. Prior to 3.21.0, FileRise enforces disableFormLogin, disableBasicAuth, and disableOIDCLogin in the client interface but not consistently in the corresponding server-side authentication flows. A user with otherwise valid credentials for a disabled method can call its backend endpoint directly and authenticate despite the administrator's login-method policy. This issue is fixed in version 3.21.0.

FileRise prior to 3.19.0 does not reject dot-dot path segments in the folderName string before FolderModel::createFolder() constructs and creates the destination. An authenticated low-privileged user with a valid CSRF token and create or owner permission on the parent can submit traversal segments to POST /api/folder/createFolder.php and create directories outside UPLOAD_DIR.

FileRise prior to 3.16.0 stores the isAdmin flag in remember-me tokens and restores that stale value during automatic login instead of resolving the account's current role from users.txt. A user who was issued a token while an administrator can retain administrator access after demotion, and token rotation copies the stale privilege into each replacement token.

FileRise prior to 3.16.0 does not apply UploadNamePolicy::isAllowedForWrite() before ZipArchive::extractTo() writes entries into the destination directory. An authenticated user with upload and extract permissions can place a blocked extension such as a PHP-family file inside a ZIP and cause it to be written to disk even when normal uploads reject that filename.

A vulnerability has been found in OAID Tengine up to 1.12.0 affecting the function get_tm_file_model in source/serializer/tmfile/tm2_serializer.c of the tmfile Model Loader component. Manipulation of the offset_root argument leads to an out-of-bounds read. The attack can be launched remotely and the exploit has been publicly disclosed.

A security flaw has been discovered in OpenClaw ClawScan up to 0.1.6 affecting the function shouldSkipTargetPath in internal/runner/runner.go of the Static Scanner component. Manipulation results in protection mechanism failure. The attack requires local access and the exploit has been publicly released.

FileRise Pro prior to 3.24.0 returns a configured client portal's full internal record to an unauthenticated caller who knows or guesses the portal slug via /api/pro/portals/get.php. The response includes the internal storage folder path, client contact email, form settings, and upload-policy details, while the separate publicMeta.php endpoint intentionally exposes only curated branding data.

FileRise before 3.23.0 validates archive entry names but extracts them directly into the destination before validating resolved paths. If the destination already contains a symlink to a directory outside the storage root, an authenticated non-administrator with extract permission can place an archive entry beneath the link and overwrite or delete an external file.

In FileRise 3.22.0, the /api/file/saveFile.php operation accepts dot and dot-dot segments in its attacker-controlled folder input before ACL inheritance evaluates the uncanonicalized string. An authenticated non-administrator with a valid CSRF token and inherited edit permission can create files outside the authorized folder and, where backend credentials permit, outside the configured WebDAV root.

FileRise before 3.23.0 permits an authenticated session with a valid CSRF token to disable TOTP without recent full reauthentication or to begin enrollment when the account has no TOTP secret. The newly generated secret is persisted and activated before a TOTP code verifies possession, allowing an attacker controlling an existing session to disable or enroll a second factor.

FileRise before 3.23.0 verifies that a TOTP code is valid for the accepted time window but does not record that the same account and time step already succeeded. An attacker with the target account's valid primary credential who captures a TOTP code after its successful use can replay that code from another pending-login session before the window closes.

FileRise before 3.23.0 in /api/folder/renameFolder.php authorizes an authenticated, non-folder-scoped, non-administrator with a valid CSRF token against the source folder but does not independently authorize a changed destination parent. A user who owns a source folder can move that tree beneath another user's folder or into the root namespace, and the operation rekeys ownership and ACL records to the new path.

A command injection vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. Exploitation requires access to the PAN-OS management interface.

An improper input handling vulnerability in the GlobalProtect gateway of Palo Alto Networks PAN-OS software enables an authenticated user to establish a GlobalProtect session using the identity of another user. Cloud NGFW and Panorama are not affected by this vulnerability.

A stack-based buffer overflow vulnerability in the log processing functionality of Palo Alto Networks PAN-OS software on Panorama enables an attacker to cause a denial of service (DoS) condition. Repeated attempts to trigger this condition result in the Panorama entering maintenance mode.

A local privilege escalation vulnerability in the Palo Alto Networks GlobalProtect app enables a local user to escalate their privileges to root on macOS. This enables a non-administrative user to execute arbitrary commands with administrative privileges.

A type confusion vulnerability in the Palo Alto Networks GlobalProtect app on Windows enables a local user with low privileges to cause a denial of service (DoS) condition. The GlobalProtect app on Linux, macOS, iOS, Android, and Chrome OS is not affected by this vulnerability.

A command injection vulnerability in the Palo Alto Networks Cortex XSOAR and Cortex XSIAM OS Query content pack enables an authenticated administrator to execute arbitrary OS commands on remote endpoints.

Path traversal vulnerabilities in Palo Alto Networks Checkov by Prisma Cloud enable an unauthenticated local user to write files to arbitrary locations on the scanning filesystem.

In WeGIA prior to 3.8.6, the pre-installation web/instalador/instalador.php endpoint is reachable before config.php exists and processes unauthenticated installation POST data. In the Linux reinstall flow, a crafted usuario value reaches a command executed by shell_exec(), and the installer writes attacker-controlled values into executable config.php and concatenates the database name nomebd into a CREATE DATABASE statement.