CVE Vulnerability Catalog

SeaweedFS is a distributed storage system for files and blobs. In versions prior to 4.40, an authenticated S3 principal with permissions scoped to a nested object key can overwrite a different object outside that scope by calling PutObjectAcl on the key it is allowed to access. The handler authorizes the request against the requested nested key but then writes the updated entry back to the bucket root rather than the key's actual parent directory, so an ACL change on allowed/protected.txt is instead applied to protected.txt at the bucket root. Because the update carries the full entry rather than only ACL metadata, an existing target object is overwritten with the content, metadata, owner information, and ACL of the scoped object, bypassing the object-level action scoping configured through the static S3 identity file. This issue is fixed in version 4.40.

SeaweedFS is a distributed storage system for files and blobs. In version 4.39, the filer's TUS resumable-upload handler checks JWT allowed_prefixes scoping only when a session is created, letting a low-privilege tenant hijack another tenant's upload session to write content to filer paths their own token forbids. The HEAD, PATCH, and DELETE verbs that act on an existing session by its id never verify that the session's stored target path falls within the caller's allowed prefixes, so a tenant who obtains another upload's session identifier can PATCH attacker bytes into it and, on completion, have the file land at the victim's out-of-scope path. The same token can also DELETE other tenants' sessions and HEAD them to read upload progress and size, defeating the JWT prefix isolation. This vulnerability only affects deployments that configure filer JWT signing and have TUS uploads enabled. This issue is fixed in version 4.40.

SeaweedFS versions 3.88 through 4.39 have a vulnerability in the SFTP server where path permissions are checked via literal string-prefix comparison, without requiring a path-component boundary. A user with access to /tenants/alice also gets access to /tenants/alice-archive, /tenants/alice2, etc. A low-privileged SFTP user can cross ACL boundaries and read or overwrite other tenants' files.

SeaweedFS versions up to 4.39 accept an external OIDC JWT in the Authorization header and map it to an IAM role without enforcing the role's trust policy. A federated user can assume a role they are not permitted to hold, gaining S3 access (read, write, delete) by presenting the raw JWT directly to the S3 API.

yx-image-recognition v1.0 is vulnerable to Path Traversal. Parameters such as dir, filePath are directly passed to new File() for file system operations without any path sanitization or whitelist validation.

In DocSys-master V2.02.85, the downloadDocEx interface in src/com/DocSystem/controller/DocController.java has an arbitrary file read vulnerability.

Plesk has a vulnerability involving improper symlink resolution before file access, allowing remote authenticated users to execute arbitrary code as root.

Plesk versions 18.0.79.7 and earlier, and 18.0.80 through 18.0.80.3, have an insecure direct object reference vulnerability, allowing remote authenticated users to read and modify other customers' databases.

A vulnerability allowing a low-privileged user to capture the NTLM credentials of the Reporter service account.

LimeSurvey Community Edition 7.0.5+260623 contains an authenticated reflected Cross-Site Scripting vulnerability in the user activation confirmation endpoint. The 'action' query parameter is copied into the response and inserted into a hidden input attribute without HTML attribute encoding.

Wings (the server control plane for Pterodactyl) versions up to and including 1.13.2 do not enforce a server's disk quota during an SFTP transfer, allowing a tenant with SFTP write access to exhaust the host node's physical disk and take down every server on it. Available space is checked only once, when the write handle is opened, using a stale cached value and without knowing the size of the incoming data.

LibreNMS versions from 21.6.0 up to 26.5.0 are vulnerable to command injection in the Signal alert transport because the signal-cli path and the Recipient field are insufficiently escaped before being passed to an exec call. An authenticated administrator can execute arbitrary OS commands on the LibreNMS host.

Simple Machines Forum (SMF) through 2.1.7, fixed in commit 6f0dc61, contains an authorization state-confusion vulnerability in the profile loader that allows authenticated low-privileged users to gain administrator access by supplying multiple values for the user parameter. Attackers can exploit the mismatch between Profile::$member and User::$me->is_owner during sequential profile loading to be treated as the owner of an administrator profile, enabling unauthorized password changes and full account takeover.

LimeSurvey Community Edition 7.0.5 contains a stored cross-site scripting vulnerability in the survey quota creation workflow. An authenticated low-privileged user who can create and manage their own survey can store malicious JavaScript in a quota message.

amqp091-go is a Go AMQP 0.9.1 client. Before version 1.13.0, a malicious AMQP broker can force the client to allocate resources and process content body frames exceeding the frame_max limit. This can lead to unexpected memory consumption or application-layer DoS, bypassing protocol constraints. Version 1.13.0 contains a fix. No workarounds are known.

AntFlow V2.0.0 is vulnerable to Incorrect Access Control. JiMuMDCCommonsRequestLoggingFilter.java retrieves the userid from the request header as the core of the identity verification mechanism, allowing attackers to forge any user identity credential information, thereby causing sensitive information leakage.

DocSys V2.02.80 is vulnerable to Any File Download. An attacker does not need to go through authentication to utilize the downloadDocEx.do interface and download any file via the parameter targetPath.

Weblate is a web-based continuous localization platform. In versions prior to 2026.7, a project administrator can read files outside their repository through the App store metadata download feature, which resolves attacker-influenced paths without confining them to the repository. This is an incomplete fix for CVE-2026-34242, allowing arbitrary file read. A user with project-admin privileges can disclose file contents on the host. Fixed in 2026.7.

Weblate is a web-based continuous localization platform. In versions prior to 2026.7, the REST API did not properly enforce team scopes, allowing users to submit invalid team configurations. By assigning projects to teams via unvalidated requests, users could grant access to unauthorized projects. This could expose private projects and allow operations outside intended permissions. Fixed in 2026.7.

LimeSurvey Community Edition 7.0.5 contains a stored cross-site scripting vulnerability in the Survey Menu Entries admin page. An authenticated user with global settings:read permission can create a survey menu entry with attacker-controlled data. The value is stored and later inserted into a single-quoted HTML title attribute without proper encoding.