Common Weakness Enumeration

CWE-610

Discouraged

Externally Controlled Reference to a Resource in Another Sphere

Abstraction: Class · Status: Draft

API response cwe.mitre.org

The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.

290 vulnerabilities reference this CWE, most recent first.

GHSA-4377-HQ3V-HGQH

Vulnerability from github – Published: 2022-12-20 21:30 – Updated: 2022-12-20 21:30
VLAI
Details

In onPreferenceClick of AccountTypePreferenceLoader.java, there is a possible way to retrieve protected files from the Settings app due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-220733496

Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2022-20515"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-610"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-12-16T16:15:00Z",
    "severity": "MODERATE"
  },
  "details": "In onPreferenceClick of AccountTypePreferenceLoader.java, there is a possible way to retrieve protected files from the Settings app due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-220733496",
  "id": "GHSA-4377-hq3v-hgqh",
  "modified": "2022-12-20T21:30:18Z",
  "published": "2022-12-20T21:30:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-20515"
    },
    {
      "type": "WEB",
      "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-442Q-2J6P-642G

Vulnerability from github – Published: 2026-07-28 21:26 – Updated: 2026-07-28 21:26
VLAI
Summary
datamodel-code-generator vulnerable to arbitrary local file read via XSD `schemaLocation` (`xs:include`/`xs:import`) path traversal, with no remote-ref gate
Details

Summary

When generating models from an XML Schema (--input-file-type xmlschema), datamodel-code-generator resolves <xs:include>, <xs:import>, <xs:redefine>, and <xs:override> schemaLocation attributes against the source directory and reads the target with no restriction to the input/base directory. An attacker who controls the input XSD can read arbitrary files via ../ traversal or an absolute path, and the included schema's contents (type names, restrictions, enumerations) are folded into the generated output. Unlike the JSON-Schema $ref path, there is no allow_remote_refs control for XSD, so --no-allow-remote-refs does not mitigate it. This is an unauthenticated path-traversal / information-disclosure issue reachable in the default configuration.

Details

The XSD parser walks include-style children and reads each schemaLocation with only an is_file() check (src/datamodel_code_generator/parser/xmlschema.py):

location = (source_dir / schema_location).resolve()   # .resolve() collapses ../, escapes base
if location in seen or not location.is_file():
    continue
included_root = self._parse_schema(_read_xml_text(location, self.encoding), location)

schema_location is attacker-controlled and _read_xml_text does path.read_bytes(). Because (source_dir / schema_location).resolve() normalizes .. and accepts absolute paths, the resolved target can be any file the process can read; there is no is_relative_to(base_path) containment (contrast the JSON-Schema HTTP-local branch, which does enforce it). The same unbounded read occurs both during version detection and during the main include-processing pass, so the included content is incorporated into the generated module.

Related vectors that were tested and do NOT apply (stdlib xml.etree.ElementTree is used): external-entity XXE file read does not occur (ElementTree does not fetch external entities), and entity-expansion "billion laughs" is rejected by CPython's expat amplification limit.

PoC

Self-contained reproducer (creates a temp dir, runs the generator, cleans up): https://gist.github.com/thegr1ffyn/c7096b797926348875d888652867eeb4 (poc.py).

Minimal manual reproduction:

mkdir -p /tmp/x/secret /tmp/x/proj
cat > /tmp/x/secret/leak.xsd <<'EOF'
<?xml version="1.0"?>
<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema">
  <xs:simpleType name="LEAK_5150"><xs:restriction base="xs:string"/></xs:simpleType>
</xs:schema>
EOF
cat > /tmp/x/proj/attack.xsd <<'EOF'
<?xml version="1.0"?>
<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema">
  <xs:include schemaLocation="../../x/secret/leak.xsd"/>
  <xs:element name="Root" type="LEAK_5150"/>
</xs:schema>
EOF
datamodel-codegen --input /tmp/x/proj/attack.xsd --input-file-type xmlschema --no-allow-remote-refs --output /tmp/x/out.py
grep LEAK_5150 /tmp/x/out.py   # content from outside the project dir appears in generated code

An absolute schemaLocation="/abs/path/leak.xsd" works identically.

Impact

Arbitrary local file read / path traversal (CWE-22) leading to information disclosure (CWE-200). Any application, CI pipeline, or multi-tenant service that generates models from an attacker-supplied XSD and exposes (returns, logs, commits, renders) the generated code is affected. The attacker can read files outside the input tree whose data is addressable as XSD content (other schemas, configs), and the read itself is an arbitrary-file-access primitive. No flag mitigates it. The attacker controls only the input schema; no authentication or special privileges are required. (Raw bytes of files that are not valid XML are read into the process but not echoed verbatim, since parsing fails; verbatim disclosure applies to XML/XSD-shaped data.)

Suggested remediation

Reject resolved schemaLocation targets that are not resolved.is_relative_to(self.base_path), and bring XSD includes under the same remote/external-reference policy enforced for JSON-Schema $ref.

Maintainer status

Confirmed by maintainer review and regression tests. The private fix PR was merged and released in 0.62.0: https://github.com/koxudaxi/datamodel-code-generator-ghsa-442q-2j6p-642g/pull/1

Fix summary: reject XSD schemaLocation targets that resolve outside the input base path, including relative traversal and absolute paths.

Release status: fixed in 0.62.0. XML Schema input support was introduced in 0.59.0, so affected versions are >= 0.59.0, <= 0.61.0.

Validation: uv run --group test --extra http pytest tests/main/xmlschema/test_main_xmlschema.py passed locally; uv run --group fix ruff check src/datamodel_code_generator/parser/xmlschema.py tests/main/xmlschema/test_main_xmlschema.py passed.

Submitted by: Hamza Haroon (thegr1ffyn)

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.61.0"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "datamodel-code-generator"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.59.0"
            },
            {
              "fixed": "0.62.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55390"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-22",
      "CWE-610"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-28T21:26:41Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\n\nWhen generating models from an XML Schema (`--input-file-type xmlschema`), `datamodel-code-generator` resolves `\u003cxs:include\u003e`, `\u003cxs:import\u003e`, `\u003cxs:redefine\u003e`, and `\u003cxs:override\u003e` `schemaLocation` attributes against the source directory and reads the target with no restriction to the input/base directory. An attacker who controls the input XSD can read arbitrary files via `../` traversal or an absolute path, and the included schema\u0027s contents (type names, restrictions, enumerations) are folded into the generated output. Unlike the JSON-Schema `$ref` path, there is no `allow_remote_refs` control for XSD, so `--no-allow-remote-refs` does not mitigate it. This is an unauthenticated path-traversal / information-disclosure issue reachable in the default configuration.\n\n### Details\n\nThe XSD parser walks include-style children and reads each `schemaLocation` with only an `is_file()` check (`src/datamodel_code_generator/parser/xmlschema.py`):\n\n```python\nlocation = (source_dir / schema_location).resolve()   # .resolve() collapses ../, escapes base\nif location in seen or not location.is_file():\n    continue\nincluded_root = self._parse_schema(_read_xml_text(location, self.encoding), location)\n```\n\n`schema_location` is attacker-controlled and `_read_xml_text` does `path.read_bytes()`. Because `(source_dir / schema_location).resolve()` normalizes `..` and accepts absolute paths, the resolved target can be any file the process can read; there is no `is_relative_to(base_path)` containment (contrast the JSON-Schema HTTP-local branch, which does enforce it). The same unbounded read occurs both during version detection and during the main include-processing pass, so the included content is incorporated into the generated module.\n\nRelated vectors that were tested and do NOT apply (stdlib `xml.etree.ElementTree` is used): external-entity XXE file read does not occur (ElementTree does not fetch external entities), and entity-expansion \"billion laughs\" is rejected by CPython\u0027s expat amplification limit.\n\n### PoC\n\nSelf-contained reproducer (creates a temp dir, runs the generator, cleans up): https://gist.github.com/thegr1ffyn/c7096b797926348875d888652867eeb4  (`poc.py`).\n\nMinimal manual reproduction:\n\n```bash\nmkdir -p /tmp/x/secret /tmp/x/proj\ncat \u003e /tmp/x/secret/leak.xsd \u003c\u003c\u0027EOF\u0027\n\u003c?xml version=\"1.0\"?\u003e\n\u003cxs:schema xmlns:xs=\"http://www.w3.org/2001/XMLSchema\"\u003e\n  \u003cxs:simpleType name=\"LEAK_5150\"\u003e\u003cxs:restriction base=\"xs:string\"/\u003e\u003c/xs:simpleType\u003e\n\u003c/xs:schema\u003e\nEOF\ncat \u003e /tmp/x/proj/attack.xsd \u003c\u003c\u0027EOF\u0027\n\u003c?xml version=\"1.0\"?\u003e\n\u003cxs:schema xmlns:xs=\"http://www.w3.org/2001/XMLSchema\"\u003e\n  \u003cxs:include schemaLocation=\"../../x/secret/leak.xsd\"/\u003e\n  \u003cxs:element name=\"Root\" type=\"LEAK_5150\"/\u003e\n\u003c/xs:schema\u003e\nEOF\ndatamodel-codegen --input /tmp/x/proj/attack.xsd --input-file-type xmlschema --no-allow-remote-refs --output /tmp/x/out.py\ngrep LEAK_5150 /tmp/x/out.py   # content from outside the project dir appears in generated code\n```\n\nAn absolute `schemaLocation=\"/abs/path/leak.xsd\"` works identically.\n\n### Impact\n\nArbitrary local file read / path traversal (CWE-22) leading to information disclosure (CWE-200). Any application, CI pipeline, or multi-tenant service that generates models from an attacker-supplied XSD and exposes (returns, logs, commits, renders) the generated code is affected. The attacker can read files outside the input tree whose data is addressable as XSD content (other schemas, configs), and the read itself is an arbitrary-file-access primitive. No flag mitigates it. The attacker controls only the input schema; no authentication or special privileges are required. (Raw bytes of files that are not valid XML are read into the process but not echoed verbatim, since parsing fails; verbatim disclosure applies to XML/XSD-shaped data.)\n\n### Suggested remediation\n\nReject resolved `schemaLocation` targets that are not `resolved.is_relative_to(self.base_path)`, and bring XSD includes under the same remote/external-reference policy enforced for JSON-Schema `$ref`.\n\n### Maintainer status\n\nConfirmed by maintainer review and regression tests. The private fix PR was merged and released in `0.62.0`: https://github.com/koxudaxi/datamodel-code-generator-ghsa-442q-2j6p-642g/pull/1\n\nFix summary: reject XSD `schemaLocation` targets that resolve outside the input base path, including relative traversal and absolute paths.\n\nRelease status: fixed in `0.62.0`. XML Schema input support was introduced in `0.59.0`, so affected versions are `\u003e= 0.59.0, \u003c= 0.61.0`.\n\nValidation: `uv run --group test --extra http pytest tests/main/xmlschema/test_main_xmlschema.py` passed locally; `uv run --group fix ruff check src/datamodel_code_generator/parser/xmlschema.py tests/main/xmlschema/test_main_xmlschema.py` passed.\n\nSubmitted by: Hamza Haroon (thegr1ffyn)",
  "id": "GHSA-442q-2j6p-642g",
  "modified": "2026-07-28T21:26:41Z",
  "published": "2026-07-28T21:26:41Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-442q-2j6p-642g"
    },
    {
      "type": "WEB",
      "url": "https://github.com/koxudaxi/datamodel-code-generator/commit/d2d5cecd9fd3a2a6dbf148bf0740b83a11fc6820"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/koxudaxi/datamodel-code-generator"
    },
    {
      "type": "WEB",
      "url": "https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.62.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "datamodel-code-generator vulnerable to arbitrary local file read via XSD `schemaLocation` (`xs:include`/`xs:import`) path traversal, with no remote-ref gate"
}

GHSA-448F-WW7H-5M58

Vulnerability from github – Published: 2022-08-29 20:06 – Updated: 2022-09-02 00:01
VLAI
Details

The Export All URLs WordPress plugin before 4.4 does not validate the path of the file to be removed on the system which is supposed to be the CSV file. This could allow high privilege users to delete arbitrary file from the server

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2022-2638"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-610",
      "CWE-73"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-08-29T18:15:00Z",
    "severity": "MODERATE"
  },
  "details": "The Export All URLs WordPress plugin before 4.4 does not validate the path of the file to be removed on the system which is supposed to be the CSV file. This could allow high privilege users to delete arbitrary file from the server",
  "id": "GHSA-448f-ww7h-5m58",
  "modified": "2022-09-02T00:01:02Z",
  "published": "2022-08-29T20:06:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2638"
    },
    {
      "type": "WEB",
      "url": "https://wpscan.com/vulnerability/70840a72-ccdc-4eee-9ad2-874809e5de11"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-45CG-2683-GFMQ

Vulnerability from github – Published: 2026-03-03 21:37 – Updated: 2026-03-19 22:19
VLAI
Summary
OpenClaw browser navigation guard allowed non-network URL schemes, enabling authenticated browser-tool users to access file:// local files
Details

Impact

assertBrowserNavigationAllowed() validated only http:/https: network targets but implicitly allowed other schemes. An authenticated gateway user could navigate browser sessions to file:// URLs and read local files via browser snapshot/extraction flows.

Affected Component

  • src/browser/navigation-guard.ts

Technical Reproduction

  1. Authenticate to a gateway that has browser tooling enabled.
  2. Invoke browser navigation with a file:// URL (for example file:///etc/passwd).
  3. Read page content through browser snapshot/extract actions.

Demonstrated Impact

An attacker with valid gateway credentials and browser-tool access can exfiltrate local files readable by the OpenClaw process user (for example config/secrets in that user context).

Environment

  • OpenClaw browser tool enabled
  • Attacker has authenticated access capable of invoking browser actions

Remediation Advice

Reject unsupported navigation schemes and allow only explicitly safe non-network URLs. OpenClaw now blocks non-network schemes (such as file:, data:, and javascript:) while preserving about:blank.

Affected Packages / Versions

  • Package: openclaw (npm)
  • Affected versions: <= 2026.2.19-2
  • Patched in planned next release: 2026.2.21

Fix Commit(s)

  • 220bd95eff6838234e8b4b711f86d4565e16e401

Release Process Note

patched_versions is pre-set to the planned next release (2026.2.21) so once npm 2026.2.21 is published, the advisory can be published directly.

OpenClaw thanks @q1uf3ng for reporting.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "openclaw"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2026.2.21"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-32008"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-610"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-03T21:37:59Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Impact\n\n`assertBrowserNavigationAllowed()` validated only `http:`/`https:` network targets but implicitly allowed other schemes. An authenticated gateway user could navigate browser sessions to `file://` URLs and read local files via browser snapshot/extraction flows.\n\n## Affected Component\n\n- `src/browser/navigation-guard.ts`\n\n## Technical Reproduction\n\n1. Authenticate to a gateway that has browser tooling enabled.\n2. Invoke browser navigation with a `file://` URL (for example `file:///etc/passwd`).\n3. Read page content through browser snapshot/extract actions.\n\n## Demonstrated Impact\n\nAn attacker with valid gateway credentials and browser-tool access can exfiltrate local files readable by the OpenClaw process user (for example config/secrets in that user context).\n\n## Environment\n\n- OpenClaw browser tool enabled\n- Attacker has authenticated access capable of invoking browser actions\n\n## Remediation Advice\n\nReject unsupported navigation schemes and allow only explicitly safe non-network URLs. OpenClaw now blocks non-network schemes (such as `file:`, `data:`, and `javascript:`) while preserving `about:blank`.\n\n## Affected Packages / Versions\n\n- Package: `openclaw` (npm)\n- Affected versions: `\u003c= 2026.2.19-2`\n- Patched in planned next release: `2026.2.21`\n\n## Fix Commit(s)\n\n- `220bd95eff6838234e8b4b711f86d4565e16e401`\n\n## Release Process Note\n\n`patched_versions` is pre-set to the planned next release (`2026.2.21`) so once npm `2026.2.21` is published, the advisory can be published directly.\n\nOpenClaw thanks @q1uf3ng for reporting.",
  "id": "GHSA-45cg-2683-gfmq",
  "modified": "2026-03-19T22:19:19Z",
  "published": "2026-03-03T21:37:59Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-45cg-2683-gfmq"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/commit/220bd95eff6838234e8b4b711f86d4565e16e401"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/openclaw/openclaw"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "OpenClaw browser navigation guard allowed non-network URL schemes, enabling authenticated browser-tool users to access file:// local files"
}

GHSA-4662-9QVH-XXM7

Vulnerability from github – Published: 2021-12-09 00:00 – Updated: 2023-08-08 15:31
VLAI
Details

A unintended proxy or intermediary ('confused deputy') in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows an unauthenticated attacker to access protected hosts via crafted HTTP requests.

Severity
6.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2021-36190"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-610"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-12-08T14:15:00Z",
    "severity": "MODERATE"
  },
  "details": "A unintended proxy or intermediary (\u0027confused deputy\u0027) in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows an unauthenticated attacker to access protected hosts via crafted HTTP requests.",
  "id": "GHSA-4662-9qvh-xxm7",
  "modified": "2023-08-08T15:31:24Z",
  "published": "2021-12-09T00:00:58Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-36190"
    },
    {
      "type": "WEB",
      "url": "https://fortiguard.com/advisory/FG-IR-21-123"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-4883-9GWJ-77MJ

Vulnerability from github – Published: 2022-05-24 17:30 – Updated: 2022-05-24 17:30
VLAI
Details

An exploitable code execution vulnerability exists in the multiple devices functionality of F2fs-Tools F2fs.Fsck 1.13. A specially crafted f2fs filesystem can cause Information overwrite resulting in a code execution. An attacker can provide a malicious file to trigger this vulnerability.

Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2020-6105"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-610"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-10-15T15:15:00Z",
    "severity": "HIGH"
  },
  "details": "An exploitable code execution vulnerability exists in the multiple devices functionality of F2fs-Tools F2fs.Fsck 1.13. A specially crafted f2fs filesystem can cause Information overwrite resulting in a code execution. An attacker can provide a malicious file to trigger this vulnerability.",
  "id": "GHSA-4883-9gwj-77mj",
  "modified": "2022-05-24T17:30:45Z",
  "published": "2022-05-24T17:30:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-6105"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/202101-26"
    },
    {
      "type": "WEB",
      "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2020-1047"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-49JR-333R-MQW3

Vulnerability from github – Published: 2023-07-06 19:24 – Updated: 2024-04-04 05:30
VLAI
Details

A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service using an operation with improper read access control that could allow files to be retrieved from any folder accessible to the account assigned to the website’s application pool.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2022-42733"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-610",
      "CWE-73"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-11-17T17:15:00Z",
    "severity": "HIGH"
  },
  "details": "A vulnerability has been identified in syngo Dynamics (All versions \u003c VA40G HF01). syngo Dynamics application server hosts a web service using an operation with improper read access control that could allow files to be retrieved from any folder accessible to the account assigned to the website\u2019s application pool.",
  "id": "GHSA-49jr-333r-mqw3",
  "modified": "2024-04-04T05:30:21Z",
  "published": "2023-07-06T19:24:04Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42733"
    },
    {
      "type": "WEB",
      "url": "https://www.siemens-healthineers.com/en-us/support-documentation/cybersecurity/shsa-741697"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-4CJP-GF5V-8843

Vulnerability from github – Published: 2025-07-09 06:30 – Updated: 2025-07-11 21:31
VLAI
Details

The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_entry_files() function in all versions up to, and including, 1.7.3. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).

Severity
8.1 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-6691"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-610",
      "CWE-73"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-07-09T06:15:23Z",
    "severity": "HIGH"
  },
  "details": "The SureForms \u2013 Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_entry_files() function in all versions up to, and including, 1.7.3. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).",
  "id": "GHSA-4cjp-gf5v-8843",
  "modified": "2025-07-11T21:31:03Z",
  "published": "2025-07-09T06:30:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6691"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/sureforms/trunk/admin/views/entries-list-table.php#L661"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3319753%40sureforms\u0026new=3319753%40sureforms\u0026sfp_email=\u0026sfph_mail="
    },
    {
      "type": "WEB",
      "url": "https://wordpress.org/plugins/sureforms"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b4658546-bf57-414b-a3c9-bf7a5692c5fe?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-4J3Q-G7JX-6RW4

Vulnerability from github – Published: 2026-05-12 18:30 – Updated: 2026-05-12 18:30
VLAI
Details

External control of file name or path in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.

Severity
7.4 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-41107"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-610",
      "CWE-73"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-12T18:17:22Z",
    "severity": "HIGH"
  },
  "details": "External control of file name or path in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.",
  "id": "GHSA-4j3q-g7jx-6rw4",
  "modified": "2026-05-12T18:30:46Z",
  "published": "2026-05-12T18:30:46Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41107"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41107"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-4M57-4HQX-RGQV

Vulnerability from github – Published: 2025-07-25 18:30 – Updated: 2025-07-25 18:30
VLAI
Details

Sitecore Experience Platform (XP) prior to 8.0 Initial Release (rev. 141212) and Content Management System (CMS) prior to 7.2 Update-3 (rev. 141226) and prior to 7.5 Update-1 (rev. 150130) contain a vulnerability that may allow an attacker to download files under the web root of the site when the name of the file is already known via a specially-crafted URL. Affected files do not include .config, .aspx or .cs files. The issue does not allow for directory browsing.

Severity
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2015-10142"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-610"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-07-25T16:15:26Z",
    "severity": "MODERATE"
  },
  "details": "Sitecore Experience Platform (XP) prior to 8.0 Initial Release (rev. 141212) and Content Management System (CMS) prior to 7.2 Update-3 (rev. 141226) and prior to\u00a07.5 Update-1 (rev. 150130) contain a vulnerability that may allow an attacker to download files under the web root of the site when the name of the file is already known via a specially-crafted URL.\u00a0Affected files do not include .config, .aspx or .cs files. The issue does not allow for directory browsing.",
  "id": "GHSA-4m57-4hqx-rgqv",
  "modified": "2025-07-25T18:30:38Z",
  "published": "2025-07-25T18:30:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-10142"
    },
    {
      "type": "WEB",
      "url": "https://support.sitecore.com/kb?id=kb_article_view\u0026sysparm_article=KB0816762"
    },
    {
      "type": "WEB",
      "url": "https://support.sitecore.com/kb?id=kb_article_view\u0026sysparm_article=KB1002377"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/sitecore-xp-cms-file-read-via-known-path"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

No mitigation information available for this CWE.

CAPEC-219: XML Routing Detour Attacks

An attacker subverts an intermediate system used to process XML content and forces the intermediate to modify and/or re-route the processing of the content. XML Routing Detour Attacks are Adversary in the Middle type attacks (CAPEC-94). The attacker compromises or inserts an intermediate system in the processing of the XML message. For example, WS-Routing can be used to specify a series of nodes or intermediaries through which content is passed. If any of the intermediate nodes in this route are compromised by an attacker they could be used for a routing detour attack. From the compromised system the attacker is able to route the XML process to other nodes of their choice and modify the responses so that the normal chain of processing is unaware of the interception. This system can forward the message to an outside entity and hide the forwarding and processing from the legitimate processing systems by altering the header information.

← Back to the CWE list