Vulnerability Disclosure Archive

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Workflow Enterprise",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "TO: fulldisclosure () seclists org\nSUBJECT: [0day-rubbish] Workflow Enterprise 9.1.0.1 Pre-authentication RCE (expression injection) (9.8)\nFROM: disclosure () 0day-rubbish com\n----BODY----\n0day Rubbish Research Team is publicly disclosing a vulnerability in Workflow Enterprise 9.1.0.1.\n\nType: Pre-authentication RCE (expression injection) (CWE-94)\nCVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)\nImpact: Unauthenticated root RCE on the Joget application server; full control of the workflow automation platform and \nits integrated ERP and approval systems.\nAuthentication: unauthenticated / pre-auth\n\nFull technical analysis and a reproducible proof-of-concept:\n  https://0day-rubbish.com/blog/joget-jrxml-expr-rce\n\nProject archive (ongoing disclosure series):\n  https://github.com/Exploit-Garbage/0day-Rubbish\n\nVendor has been notified. CVE ID is pending.\n\n--\n0day Rubbish Research Team\ndisclosure () 0day-rubbish com\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-07T13:20:21Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/51"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/51"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/joget-jrxml-expr-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/51"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[0day-rubbish] Workflow Enterprise 9.1.0.1 Pre-authentication RCE (expression injection) (9.8)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0072",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/51",
            "automated": true,
            "contentSha256": "02f6d5cb1cd6f8ea07966e7abd2572653b35fe1f77feea8d633b3894a16f7550",
            "evidenceScore": 11,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/51",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-15T07:26:21Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-07T13:20:21Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0072"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Vocia MS-1 Firmware",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "TO: fulldisclosure () seclists org\nSUBJECT: [0day-rubbish] Vocia MS-1 Firmware 1.2.27 Pre-authentication RCE (hardcoded credentials + supervisor \nexecution) (9.8)\nFROM: disclosure () 0day-rubbish com\n----BODY----\n0day Rubbish Research Team is publicly disclosing a vulnerability in Vocia MS-1 Firmware 1.2.27.\n\nType: Pre-authentication RCE (hardcoded credentials + supervisor execution) (CWE-798)\nCVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)\nImpact: Unauthenticated root code execution on the device; full control of public-address and intercom infrastructure \nin transportation hubs, government buildings, schools, and hospitals.\nAuthentication: unauthenticated / pre-auth\n\nFull technical analysis and a reproducible proof-of-concept:\n  https://0day-rubbish.com/blog/biamp-vocia-ftps-root\n\nProject archive (ongoing disclosure series):\n  https://github.com/Exploit-Garbage/0day-Rubbish\n\nVendor has been notified. CVE ID is pending.\n\n--\n0day Rubbish Research Team\ndisclosure () 0day-rubbish com\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-798",
              "description": "CWE-798",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-07T13:20:21Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/49"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/49"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/biamp-vocia-ftps-root"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/49"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[0day-rubbish] Vocia MS-1 Firmware 1.2.27 Pre-authentication RCE (hardcoded credentials + supervisor execution) (9.8)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0070",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/49",
            "automated": true,
            "contentSha256": "1899f46f089abde0e21181ef8422c9d0cb1b8fbf6cde44b21e6c42c26054b5af",
            "evidenceScore": 11,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/49",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-15T07:25:52Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-07T13:20:21Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0070"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Enterprise ADC",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "TO: fulldisclosure () seclists org\nSUBJECT: [0day-rubbish] Enterprise ADC 8.13.8 Authenticated RCE (command injection + passwordless sudo) (8.8)\nFROM: disclosure () 0day-rubbish com\n----BODY----\n0day Rubbish Research Team is publicly disclosing a vulnerability in Enterprise ADC 8.13.8.\n\nType: Authenticated RCE (command injection + passwordless sudo) (CWE-78)\nCVSS: 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)\nImpact: Full device compromise as root on the load balancer, placing the north-south traffic of the networks it fronts \nat risk.\nAuthentication: authenticated (requires valid session)\n\nFull technical analysis and a reproducible proof-of-concept:\n  https://0day-rubbish.com/blog/loadbalancer-org-template-root\n\nProject archive (ongoing disclosure series):\n  https://github.com/Exploit-Garbage/0day-Rubbish\n\nVendor has been notified. CVE ID is pending.\n\n--\n0day Rubbish Research Team\ndisclosure () 0day-rubbish com\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-07T13:20:21Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/48"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/48"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/loadbalancer-org-template-root"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/48"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[0day-rubbish] Enterprise ADC 8.13.8 Authenticated RCE (command injection + passwordless sudo) (8.8)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0069",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/48",
            "automated": true,
            "contentSha256": "d2125463400ff55206ce0149e2af261c2d5a94694400d962b32bd5e1ebba0d86",
            "evidenceScore": 11,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/48",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-15T07:25:39Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-07T13:20:21Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0069"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "KeyHelp",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "TO: fulldisclosure () seclists org\nSUBJECT: [0day-rubbish] KeyHelp 26.0 (Build 3624) Authenticated RCE (command injection via Apache directive) (7.2)\nFROM: disclosure () 0day-rubbish com\n----BODY----\n0day Rubbish Research Team is publicly disclosing a vulnerability in KeyHelp 26.0 (Build 3624).\n\nType: Authenticated RCE (command injection via Apache directive) (CWE-78)\nCVSS: 7.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H)\nImpact: Admin-to-root full server takeover. All hosted domains, customer data, panel data, and other host services are \nat risk.\nAuthentication: authenticated (requires valid session)\n\nFull technical analysis and a reproducible proof-of-concept:\n  https://0day-rubbish.com/blog/keyhelp-errorlog-pipe-root\n\nProject archive (ongoing disclosure series):\n  https://github.com/Exploit-Garbage/0day-Rubbish\n\nVendor has been notified. CVE ID is pending.\n\n--\n0day Rubbish Research Team\ndisclosure () 0day-rubbish com\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-07T13:20:21Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/47"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/47"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/keyhelp-errorlog-pipe-root"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/47"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[0day-rubbish] KeyHelp 26.0 (Build 3624) Authenticated RCE (command injection via Apache directive) (7.2)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0068",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/47",
            "automated": true,
            "contentSha256": "d962537034f728c5c58a238b12f5821a3f7c1fbe4579b5e32a9f3c839e991c3f",
            "evidenceScore": 11,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/47",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-15T07:25:26Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-07T13:20:21Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0068"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "InsightEdge Enterprise XAP",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "TO: fulldisclosure () seclists org\nSUBJECT: [0day-rubbish] InsightEdge Enterprise (XAP IMDg) 16.1.1 Pre-authentication RCE (path traversal + JSP webshell) \n(9.8)\nFROM: disclosure () 0day-rubbish com\n----BODY----\n0day Rubbish Research Team is publicly disclosing a vulnerability in InsightEdge Enterprise (XAP IMDg) 16.1.1.\n\nType: Pre-authentication RCE (path traversal + JSP webshell) (CWE-22)\nCVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)\nImpact: Unauthenticated arbitrary file write and root command execution on the management host and data grid, including \nthe in-memory data and analytics platforms serving transaction processing.\nAuthentication: unauthenticated / pre-auth\n\nFull technical analysis and a reproducible proof-of-concept:\n  https://0day-rubbish.com/blog/gigaspaces-xap-unauth-webshell\n\nProject archive (ongoing disclosure series):\n  https://github.com/Exploit-Garbage/0day-Rubbish\n\nVendor has been notified. CVE ID is pending.\n\n--\n0day Rubbish Research Team\ndisclosure () 0day-rubbish com\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-07T13:20:21Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/45"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/45"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/gigaspaces-xap-unauth-webshell"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/45"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[0day-rubbish] InsightEdge Enterprise (XAP IMDg) 16.1.1 Pre-authentication RCE (path traversal + JSP webshell) (9.8)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0066",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/45",
            "automated": true,
            "contentSha256": "7ce1b56623fb98ab73bcbe8548c242f7e930f9a43ea854275a36dcd2fcaacea8",
            "evidenceScore": 11,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/45",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-15T07:24:59Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-07T13:20:21Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0066"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "SCHUTZWERK-SA-2025-001 Authentication Bypass",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jan H\u00fcber via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA512\n\nAuthentication Bypass for SafeLine SL6 and SL6+\n===============================================\n\n\ngain unauthorized administrative access to the device configuration.\n\nMetadata\n========\n\n* Affected product: SafeLine SL6/SL6+\n* Affected version: Introduced in version 4.82, patched in version 4.97\n* Vendor: SafeLine\n* Problem type(s): CWE-305 Authentication bypass by primary weakness\n* CVE ID: CVE-2025-4994\n* CVE URL: https://www.cve.org/CVERecord?id=CVE-2025-4994\n* CVSS 4.0 score: 8.7\n* Advisory URL: https://www.schutzwerk.com/blog/schutzwerk-sa-2025-001/\n\nDetails\n=======\n\n\ndepending on the \"Auto Enable BLE\" configuration setting:\n\n\n\u00a0 by a configurable PIN.\n\n\u00a0 enabled by a reboot.\n\n\nto the target device and is fully reproducible.\n\nRisk\n====\n\n\nan incident.\n\nWorkaround\n==========\n\n\ninterface.\n\nSolution/Mitigation\n===================\n\n\n\n\nshould be applied.\n\nTimeline\n========\n\n* 2025-03-28 Vulnerability discovered\n* 2025-04-14 Initial contact with vendor\n* 2025-04-16 Vulnerability reported to technical support of vendor\n* 2025-05-08 Follow-up meeting was canceled by vendor\n* 2025-05-16 Initial contact with CTO of vendor\n* 2025-05-28 Vulnerability presented to CTO of vendor\n* 2025-06-16 Vendor informed SCHUTZWERK that the patch is currently tested\n* 2025-07-03 Follow-up meeting was canceled by vendor\n* 2025-07-31 Follow-up meeting was requested by SCHUTZWERK\n* 2025-08-21 Vendor informed SCHUTZWERK that the patch was postponed\n* 2025-08-28 Vendor informed SCHUTZWERK that the patch is currently tested\n* 2025-12-19 Vendor informed SCHUTZWERK that the patch was released\n\n\u00a0 scheduled maintenance windows\n* 2026-06-19 Advisory released by SCHUTZWERK\n\nCredits\n=======\n\nThe vulnerability was discovered by Jan H\u00fcber of SCHUTZWERK GmbH\n-----BEGIN PGP SIGNATURE-----\n\niQJOBAEBCgA4FiEEgLsg7Oj/wY3LSF87GrXfkTIXLrsFAmpLjrQaHGFkdmlzb3Jp\nZXNAc2NodXR6d2Vyay5jb20ACgkQGrXfkTIXLruNEA/+IiLtH9rqkwhZA3H0qWQp\nZ6xH/M7Som+OkCn/qgZ7khBKi2qsC0jdA7ePf/D3LY2VlgA9Y60fAETXarNj2X/y\nKgB80TjrPRwBhPhdZKxhn14DCPjLANGVYVDanfR0oQmRzZ8aEjb9No6G04nb+qCV\nu7c1aD5Hl0vJRI7AAgkHjz1etgsYm7MKkJYHxhCuJFw2B4XpPjk9TREgofdC3FLk\nVkO5xMRUysMy9Sgy8qzesSySX5UHKoPVtndo/EVvDsUJccsIL6WdE4z4odMJ9cRE\nr8CX6LAnyhfktgDf8eOgzysfdkYl//0KO1IIGF8ghLqRDpgWkMZTHc2/GXPnPYL1\n3uIXI7vG8jGJ99fIijocplug9BAnQnK+w7PBJOzroWMOQC7zJWwy6gL2H/vYIatp\nFQFlgF5DnMBdjWX80Gu5CIDPYIVlXW15k7TNF/k5XUW3Uh6/uk8FTLgzPFsR707j\nXsWPKk7XICiizJDv2su8rmTtCpPtgHhC0HUoJa6eVBj+37l4EuPS0jpYEByfkmNY\ne+eka/F0kF4FzxAp2jWfE4A+QLlP6GGgZSLlfybVgvsjUe468intIDHaR9CPlv74\nDtLWZ3zr4OXTare4hm7F0dLN80WAG3A6ELsrqGknaKvD4ePaSBLdkL8q9tKZIQL5\nMUv9NZtj3B224OsNyt8EhjA=\n=JAMF\n-----END PGP SIGNATURE-----\n\n--\nSCHUTZWERK GmbH, Pfarrer-Wei\u00df-Weg 12, 89077 Ulm, Germany\nZertifiziert / Certified ISO 27001, 9001 and TISAX\n\nPhone +49 731 977 191 0\n\nadvisories () schutzwerk com / www.schutzwerk.com\n\nGesch\u00e4ftsf\u00fchrer / Managing Directors:\nJakob Pietzka, Michael Sch\u00e4fer\n\nAmtsgericht Ulm /  HRB 727391\nDatenschutz / Data Protection www.schutzwerk.com/datenschutz\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-305",
              "description": "CWE-305",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-07T13:20:21Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/17"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jul/17"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-4994"
        },
        {
          "url": "https://www.schutzwerk.com/blog/schutzwerk-sa-2025-001/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jul/17"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "SCHUTZWERK-SA-2025-001: Authentication Bypass for SafeLine SL6 and SL6+",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0064",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/17",
            "automated": true,
            "contentSha256": "bc6c342cc53996cd7d0cca6d5aaabd93c68cf21047b68bdfb4e82668635ad803",
            "evidenceScore": 8,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jul/17",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-07-06T11:24:41Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-07T13:20:21Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0064"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Telenia Software TVox",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Egidio Romano"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-------------------------------------------------------------------------------\nTelenia Software TVox \u003c= 26.5.3 (nice) Local Privilege Escalation\nVulnerability\n-------------------------------------------------------------------------------\n\n\n[-] Software Link:\n\nhttps://www.teleniasoftware.com\n\n\n[-] Affected Versions:\n\nVersion 26.5.3 and prior 26.x versions.\nVersion 24.9.21 and prior 24.x versions.\nOlder versions may be affected as well.\n\n\n[-] Vulnerability Description:\n\nThe vulnerability is caused by an insecure sudoers configuration in the\n/etc/sudoers.d/telenia file:\n\n\napache ALL=NOPASSWD: /opt/telenia/cloud/bin/check-instance-id\n\napache ALL=NOPASSWD: /usr/sbin/postsuper\n\napache ALL=NOPASSWD: /bin/nice\napache ALL=NOPASSWD: /usr/bin/hostnamectl\napache ALL=NOPASSWD: /sbin/halt\napache ALL=NOPASSWD: /sbin/reboot\n\n\nThe apache user is allowed to execute the \"nice\" command with root\nprivileges without requiring a password. Since \"nice\" can be abused to\ninvoke arbitrary commands, this misconfiguration enables an attacker with\naccess to the apache account to execute arbitrary commands as the root\nuser, resulting in a Local Privilege Escalation.\n\n\n[-] Proof of Concept:\n\nhttps://karmainsecurity.com/pocs/tvox_root_rce.php\n\n\n[-] Solution:\n\nNo official solution is currently available.\n\n\n[-] Disclosure Timeline:\n\n[22/05/2026] - Vendor was contacted, no response\n[27/05/2026] - Vendor was notified about this vulnerability, no response\n[27/05/2026] - Vendor was notified about 60-day disclosure deadline policy,\nno response\n[26/06/2026] - Vendor was contacted again along with CSIRT Italy, no\nresponse from CSIRT\n[08/07/2026] - First vendor response, asking for vulnerability details\n[09/07/2026] - Vulnerability details safely provided to the vendor\n[20/07/2026] - Vendor was contacted again, asking for an update\n[21/07/2026] - Vendor replied a security patch will be released by the end\nof July\n[21/07/2026] - CVE identifier requested\n[21/07/2026] - CVE identifier assigned\n[27/07/2026] - Reached 60-day disclosure deadline, still no official\nsolution\n[03/08/2026] - Public disclosure\n\n\n[-] CVE Reference:\n\nCVE-2026-64829 has been assigned to this vulnerability.\n\n\n[-] Credits:\n\nVulnerability discovered by Egidio Romano.\n\n\n[-] Original Advisory:\n\nhttps://karmainsecurity.com/KIS-2026-16\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-07T13:20:21Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/32"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/32"
        },
        {
          "url": "https://karmainsecurity.com/KIS-2026-16"
        },
        {
          "url": "https://karmainsecurity.com/pocs/tvox_root_rce.php"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.teleniasoftware.com"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/32"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[KIS-2026-16] Telenia Software TVox \u003c= 26.5.3 (nice) Local Privilege Escalation Vulnerability",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0063",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/32",
            "automated": true,
            "contentSha256": "6fe3bdfe6e52b71acd1d426aa72052689d91f1538bde6a1175e9fab3479a1984",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/32",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-03T07:30:11Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-07T13:20:21Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0063"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Telenia Software TVox",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Egidio Romano"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-------------------------------------------------------------------------------------\nTelenia Software TVox \u003c= 26.5.3 (action_audio.php) OS Command Injection\nVulnerability\n-------------------------------------------------------------------------------------\n\n\n[-] Software Link:\n\nhttps://www.teleniasoftware.com\n\n\n[-] Affected Versions:\n\nVersion 26.5.3 and prior 26.x versions.\nVersion 24.9.21 and prior 24.x versions.\nOlder versions may be affected as well.\n\n\n[-] Vulnerability Description:\n\nThe vulnerable code is located within the\n/opt/telenia/tvox/php/siti/t-vox/manager/html/action_audio.php script:\n\n180.    case \"checkProcess\":\n181.        $pid = @trim($_REQUEST[\"pid\"]);\n182.        $logFile = @trim($_REQUEST[\"logFile\"]);\n183.        if ($pid != \"\")\n184.            exec(\u0027ps -p \u0027 . $_REQUEST[\"pid\"], $output);\n\nUser input passed through the \"pid\" request parameter (when the \"action\"\nrequest parameter is set to \"checkProcess\") is not properly sanitized\nbefore being used to execute OS commands via an exec() call at line 184.\nThis can be exploited to inject and execute arbitrary OS commands with the\nprivileges of the \"apache\" user on the web server.\n\n\n[-] Proof of Concept:\n\nhttps://karmainsecurity.com/pocs/tvox_root_rce.php\n\n\n[-] Solution:\n\nNo official solution is currently available.\n\n\n[-] Disclosure Timeline:\n\n[22/05/2026] - Vendor was contacted, no response\n[26/05/2026] - Vendor was notified about this vulnerability, no response\n[27/05/2026] - Vendor was notified about 60-day disclosure deadline policy,\nno response\n[26/06/2026] - Vendor was contacted again along with CSIRT Italy, no\nresponse from CSIRT\n[08/07/2026] - First vendor response, asking for vulnerability details\n[09/07/2026] - Vulnerability details safely provided to the vendor\n[20/07/2026] - Vendor was contacted again, asking for an update\n[21/07/2026] - Vendor replied a security patch will be released by the end\nof July\n[21/07/2026] - CVE identifier requested\n[21/07/2026] - CVE identifier assigned\n[27/07/2026] - Reached 60-day disclosure deadline, still no official\nsolution\n[03/08/2026] - Public disclosure\n\n\n[-] CVE Reference:\n\nCVE-2026-64828 has been assigned to this vulnerability.\n\n\n[-] Credits:\n\nVulnerability discovered by Egidio Romano.\n\n\n[-] Original Advisory:\n\nhttps://karmainsecurity.com/KIS-2026-15\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-07T13:20:21Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/31"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/31"
        },
        {
          "url": "https://karmainsecurity.com/KIS-2026-15"
        },
        {
          "url": "https://karmainsecurity.com/pocs/tvox_root_rce.php"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.teleniasoftware.com"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/31"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[KIS-2026-15] Telenia Software TVox \u003c= 26.5.3 (action_audio.php) OS Command Injection Vulnerability",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0062",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/31",
            "automated": true,
            "contentSha256": "750a1c9853cbaf029db7a8361d781a98c8c41779467bc804c2ba737e24db81ff",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/31",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-03T07:29:12Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-07T13:20:21Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0062"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Telenia Software TVox",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Egidio Romano"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "---------------------------------------------------------------------------------\nTelenia Software TVox \u003c= 26.5.3 (set_env.php) Authentication Bypass\nVulnerability\n---------------------------------------------------------------------------------\n\n\n[-] Software Link:\n\nhttps://www.teleniasoftware.com\n\n\n[-] Affected Versions:\n\nVersion 26.5.3 and prior 26.x versions.\nVersion 24.9.21 and prior 24.x versions.\nOlder versions may be affected as well.\n\n\n[-] Vulnerability Description:\n\nThe vulnerable code is located within the\n/opt/telenia/tvox/php/siti/t-vox/manager/set_env.php script. Specifically,\ninto the redirectToLoginAdminIRequestHaveAccessToken() function:\n\n293. function redirectToLoginAdminIRequestHaveAccessToken($force = false) {\n294.    $current_page = str_replace(\"/\", \"\", strrchr($_SERVER[\u0027PHP_SELF\u0027],\n\"/\"));\n295.    if ($current_page != \"login_admin.php\") {\n296.        $request_uri = $_SERVER[\"REQUEST_URI\"];\n297.        $accessToken = @trim($force ? $_REQUEST[\"access_token\"] :\n$_GET[\"access_token\"]);\n298.\n299.        if ($accessToken !== \"\" \u0026\u0026 (!isset($_SESSION[\"wso2auth\"]) || (\nisset($_SESSION[\"wso2auth\"]) \u0026\u0026 $_SESSION[\"wso2auth\"]-\u003eaccessToken !==\ntrim($accessToken)) )) {\n300.            $force = true;\n301.            if (@trim($_GET[\"access_token\"]) != \"\") {\n302.                $parsedUrl = parse_url($request_uri);\n303.                $parsedUrl[\"query\"] =\nquery_string_exclude(array(\u0027access_token\u0027), $_GET);\n304.                if ($parsedUrl[\"query\"] != \"\") {\n305.                    $request_uri = $parsedUrl[\"path\"] . \"?\" .\n$parsedUrl[\"query\"];\n306.                }\n307.            }\n308.        }\n309.\n310.        if ($force) {\n311.            $_SESSION[\"request_uri\"] = $request_uri;\n312.            unset($_REQUEST[\"access_token\"]);\n313.            $_SESSION[\u0027requestSave\u0027] = $_REQUEST;\n314.            header(\"Location: /tvox/manager/html/login_admin.php\" . (\n$accessToken === \"\" ? \"\" : \"?access_token=\" . $accessToken ));\n315.            exit;\n316.        }\n317.    }\n318. }\n\nThis function is invoked to verify whether the user is already\nauthenticated. If the user is not authenticated, execution reaches line\n314, where the user is redirected to the login page, and it terminates at\nline 315 via an exit statement. The issue is that this authentication check\nis only enforced when the value of the $current_page variable differs from\n\"login_admin.php\" (line 295). Since $current_page is populated using the\nvalue of $_SERVER[\u0027PHP_SELF\u0027] (at line 294), an attacker can bypass the\nauthentication check by simply appending the string \"/login_admin.php\" to\nthe path of the target PHP script. As a result, the application incorrectly\ntreats the request as if it were targeting the login page, allowing\nunauthenticated access to all PHP scripts exposed under the\n/tvox/manager/html/ path.\n\n\n[-] Proof of Concept:\n\nhttps://karmainsecurity.com/pocs/tvox_root_rce.php\n\n\n[-] Solution:\n\nNo official solution is currently available.\n\n\n[-] Disclosure Timeline:\n\n[22/05/2026] - Vendor was contacted, no response\n[26/05/2026] - Vendor was notified about this vulnerability, no response\n[27/05/2026] - Vendor was notified about 60-day disclosure deadline policy,\nno response\n[26/06/2026] - Vendor was contacted again along with CSIRT Italy, no\nresponse from CSIRT\n[08/07/2026] - First vendor response, asking for vulnerability details\n[09/07/2026] - Vulnerability details safely provided to the vendor\n[20/07/2026] - Vendor was contacted again, asking for an update\n[21/07/2026] - Vendor replied a security patch will be released by the end\nof July\n[21/07/2026] - CVE identifier requested\n[21/07/2026] - CVE identifier assigned\n[27/07/2026] - Reached 60-day disclosure deadline, still no official\nsolution\n[03/08/2026] - Public disclosure\n\n\n[-] CVE Reference:\n\nCVE-2026-64827 has been assigned to this vulnerability.\n\n\n[-] Credits:\n\nVulnerability discovered by Egidio Romano.\n\n\n[-] Original Advisory:\n\nhttps://karmainsecurity.com/KIS-2026-14\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-07T13:20:21Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/30"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/30"
        },
        {
          "url": "https://karmainsecurity.com/KIS-2026-14"
        },
        {
          "url": "https://karmainsecurity.com/pocs/tvox_root_rce.php"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.teleniasoftware.com"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/30"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[KIS-2026-14] Telenia Software TVox \u003c= 26.5.3 (set_env.php) Authentication Bypass Vulnerability",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0061",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/30",
            "automated": true,
            "contentSha256": "db796cc3baba52f714319d385500cac70859e39161a1b0031005a3f55d87eb2a",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/30",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-03T07:28:02Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-07T13:20:21Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0061"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Zig std.http chunked",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Agent Spooky\u0027s Fun Parade via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Agent Spooky\u2019s Fun Parade hereby reports, with the solemnity of a raccoon presenting a subpoena, an integer-overflow \npanic in Zig\u2019s std.http chunked request-body reader. In Zig 0.16.0 and master commit 8f7febfa6f59, \nReader.chunkedReadEndless and Reader.chunkedDiscardEndless compute cp.chunk_len + 2 - n after ChunkParser.feed has \naccepted chunk lengths up to 0xffffffffffffffff. Unfortunately, the downstream arithmetic only remains safe for \nchunk_len \u003c= maxInt(u64) - 2, meaning chunk sizes fffffffffffffffe and ffffffffffffffff are valid enough to enter the \ntemple and cursed enough to set it on fire.\u00b9\n\nThe practical effect is unauthenticated remote denial of service against std.http.Server users that read or discard \nrequest bodies. A single HTTP/1.1 request with Transfer-Encoding: chunked and first chunk-size line fffffffffffffffe \nreaches the checked u64 addition; in Debug and ReleaseSafe this produces panic: integer overflow and aborts the \nworker/process. In ReleaseFast/ReleaseSmall the same expression wraps instead, corrupting chunk-length tracking rather \nthan producing the neat educational corpse we get in safe builds. Our in-process PoC drives the real std.http.Server \nover fixed buffers and reproduces the panic at /usr/lib/zig/std/http.zig:586, which is convenient because nothing says \n\u201csystems programming\u201d like having your HTTP parser defeated by two bytes of conceptual optimism.\n\n// poc.zig \u2014 build: `zig build-exe poc.zig` (Debug) ; run: `./poc`\nconst std = @import(\"std\");\nconst http = std.http;\n\npub fn main() !void {\nconst body = \"A\" ** 300; // \u2265 read-buffer so the read is buffer-bounded, not EOF-bounded\nconst request_bytes =\n\"POST /upload HTTP/1.1\\r\\n\" ++\n\"Host: victim\\r\\n\" ++\n\"Transfer-Encoding: chunked\\r\\n\" ++\n\"\\r\\n\" ++\n\"fffffffffffffffe\\r\\n\" ++ // chunk-size = 0xFFFF_FFFF_FFFF_FFFE = 2^64 - 2\nbody;\n\nvar in = std.Io.Reader.fixed(request_bytes);\nvar out_buf: [4096]u8 = undefined;\nvar out = std.Io.Writer.fixed(\u0026out_buf);\n\nvar server = http.Server.init(\u0026in, \u0026out);\nvar request = try server.receiveHead(); // Head.parse accepts TE:chunked\n\nvar transfer_buf: [256]u8 = undefined;\nconst br = try request.readerExpectContinue(\u0026transfer_buf);\nvar dst: [256]u8 = undefined;\n_ = try br.readSliceShort(\u0026dst); // -\u003e panic at http.zig:586}\n\n\nRoot cause: the parser accepts the full [0, 2^64-1] chunk-size domain while the reader silently assumes [0, 2^64-3]. \nSuggested fix is to reject any parsed chunk length above std.math.maxInt(u64) - 2 in ChunkParser.feed, or preferably \nimpose a sane implementation maximum far below \u201cthe heat death of RAM.\u201d Separately, Request.Head.parse should reject \nrequests containing both Content-Length and Transfer-Encoding per RFC 7230 \u00a73.3.3, because accepting both and letting \nchunked win is how one accidentally becomes a boutique smuggling-adjacent artisan.\u00b2\n\nCWE-190, secondary CWE-1284, tertiary CWE-617. CVSS v3.0: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.\nCVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N.\nConfidentiality and integrity are not demonstrated; availability loss is the show, the whole show, and the clown car it \narrived in.\n\n\u00b9 \u201cValid enough to enter, cursed enough to set it on fire\u201d is not yet an IETF term, but we are submitting an erratum to \nreality.\u00b2 Footnote \u00b2 exists only to prove the report has layers, like an onion, or a parser state machine written \nduring a thunderstorm.\n\nCheers!\n\nAgent Spooky\u0027s Fun Parade\n\n[agent-spooky-1.png]\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1284",
              "description": "CWE-1284",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-190",
              "description": "CWE-190",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-617",
              "description": "CWE-617",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-07T13:20:21Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/0"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jul/0"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jul/0"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Zig std.http chunked reader integer overflow -\u003e unauthenticated remote DoS",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0047",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/0",
            "automated": true,
            "contentSha256": "ee9275e5051b4ddd56cb304c6e6cc465817417ee75fe1a18379408ee5024c147",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jul/0",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-06-29T01:17:59Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-07T13:20:21Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0047"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}