Search
Find a vulnerability
Search criteria
8 vulnerabilities found for pipeshub-ai by pipeshub-ai
CVE-2026-119712 (GCVE-0-2026-119712)
Vulnerability from nvd – Published: 2026-10-30 15:16 – Updated: 2026-10-30 15:19
VLAI
EPSS
VEX
Title
PipesHub before 0.10.0 SSRF via Image URLs in Indexed Documents
Summary
PipesHub before 0.10.0 contains a server-side request forgery vulnerability in ImageParser._fetch_single_url that allows attackers to make the indexing service fetch internal addresses by embedding image URLs in documents. Attackers can supply Markdown or HTML via uploads, synced mailboxes, or web connectors to reach loopback, private-network, or cloud metadata endpoints, with image responses embedded into indexed content.
Severity
6.4 (Medium)
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/pipeshub-ai/pipeshub-ai/securi… | vendor-advisory |
| https://github.com/pipeshub-ai/pipeshub-ai/commit… | patch |
| https://github.com/pipeshub-ai/pipeshub-ai/blob/v… | technical-description |
| https://github.com/pipeshub-ai/pipeshub-ai/releas… | release-notes |
| https://github.com/pipeshub-ai/pipeshub-ai | product |
| https://www.vulncheck.com/advisories/pipeshub-bef… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pipeshub-ai | pipeshub-ai |
Affected:
0 , < 0.10.0
(semver)
cpe:2.3:a:pipeshub:pipeshub:*:*:*:*:*:*:*:* |
Date Public
2026-10-25 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "pipeshub-ai",
"vendor": "pipeshub-ai",
"versions": [
{
"lessThan": "0.10.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:pipeshub:pipeshub:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.10.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hyderpwn"
}
],
"datePublic": "2026-10-25T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PipesHub before 0.10.0 contains a server-side request forgery vulnerability in ImageParser._fetch_single_url that allows attackers to make the indexing service fetch internal addresses by embedding image URLs in documents. Attackers can supply Markdown or HTML via uploads, synced mailboxes, or web connectors to reach loopback, private-network, or cloud metadata endpoints, with image responses embedded into indexed content."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T15:19:20.964Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-mp2g-r37c-fx9q)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/pipeshub-ai/pipeshub-ai/security/advisories/GHSA-mp2g-r37c-fx9q"
},
{
"tags": [
"patch"
],
"url": "https://github.com/pipeshub-ai/pipeshub-ai/commit/16b05ed7c4c492330046fa10753389a5a5886613"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pipeshub-ai/pipeshub-ai/blob/v0.9.1/backend/python/app/modules/parsers/image_parser/image_parser.py"
},
{
"name": "pipeshub-ai v0.10.0 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/pipeshub-ai/pipeshub-ai/releases/tag/v0.10.0"
},
{
"tags": [
"product"
],
"url": "https://github.com/pipeshub-ai/pipeshub-ai"
},
{
"name": "VulnCheck Advisory: PipesHub before 0.10.0 SSRF via Image URLs in Indexed Documents",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pipeshub-before-0.10.0-ssrf-via-image-urls-in-indexed-documents"
}
],
"title": "PipesHub before 0.10.0 SSRF via Image URLs in Indexed Documents",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119712",
"datePublished": "2026-10-30T15:16:11.556Z",
"dateReserved": "2026-10-30T14:49:25.674Z",
"dateUpdated": "2026-10-30T15:19:20.964Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119711 (GCVE-0-2026-119711)
Vulnerability from nvd – Published: 2026-10-30 15:16 – Updated: 2026-10-30 15:16
VLAI
EPSS
VEX
Title
PipesHub before 0.10.0 Rate Limit Bypass via Spoofed X-Forwarded-For Header
Summary
PipesHub before 0.10.0 contains a rate limit bypass vulnerability in getClientIp() that allows unauthenticated attackers to evade per-IP throttling by spoofing X-Forwarded-For or X-Real-IP headers. Attackers can rotate header values to obtain fresh rate-limit buckets on authentication endpoints, enabling password spraying and OTP or password-reset email flooding.
Severity
5.3 (Medium)
CWE
- CWE-348 - Use of Less Trusted Source
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/pipeshub-ai/pipeshub-ai/securi… | vendor-advisory |
| https://github.com/pipeshub-ai/pipeshub-ai/commit… | patch |
| https://github.com/pipeshub-ai/pipeshub-ai/blob/v… | technical-description |
| https://github.com/pipeshub-ai/pipeshub-ai/releas… | release-notes |
| https://github.com/pipeshub-ai/pipeshub-ai | product |
| https://www.vulncheck.com/advisories/pipeshub-bef… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pipeshub-ai | pipeshub-ai |
Affected:
0 , < 0.10.0
(semver)
cpe:2.3:a:pipeshub:pipeshub:*:*:*:*:*:*:*:* |
Date Public
2026-10-25 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "pipeshub-ai",
"vendor": "pipeshub-ai",
"versions": [
{
"lessThan": "0.10.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:pipeshub:pipeshub:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.10.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hyderpwn"
}
],
"datePublic": "2026-10-25T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PipesHub before 0.10.0 contains a rate limit bypass vulnerability in getClientIp() that allows unauthenticated attackers to evade per-IP throttling by spoofing X-Forwarded-For or X-Real-IP headers. Attackers can rotate header values to obtain fresh rate-limit buckets on authentication endpoints, enabling password spraying and OTP or password-reset email flooding."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-348",
"description": "Use of Less Trusted Source",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T15:16:10.897Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-78gw-g2h7-xvjj)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/pipeshub-ai/pipeshub-ai/security/advisories/GHSA-78gw-g2h7-xvjj"
},
{
"tags": [
"patch"
],
"url": "https://github.com/pipeshub-ai/pipeshub-ai/commit/84614464bb120e9f8e8c85420001260e709d99bb"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pipeshub-ai/pipeshub-ai/blob/v0.9.1/backend/nodejs/apps/src/libs/middlewares/rate-limit.middleware.ts"
},
{
"name": "pipeshub-ai v0.10.0 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/pipeshub-ai/pipeshub-ai/releases/tag/v0.10.0"
},
{
"tags": [
"product"
],
"url": "https://github.com/pipeshub-ai/pipeshub-ai"
},
{
"name": "VulnCheck Advisory: PipesHub before 0.10.0 Rate Limit Bypass via Spoofed X-Forwarded-For Header",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pipeshub-before-0.10.0-rate-limit-bypass-via-spoofed-x-forwarded-for-header"
}
],
"title": "PipesHub before 0.10.0 Rate Limit Bypass via Spoofed X-Forwarded-For Header",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119711",
"datePublished": "2026-10-30T15:16:10.897Z",
"dateReserved": "2026-10-30T14:49:25.278Z",
"dateUpdated": "2026-10-30T15:16:10.897Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119710 (GCVE-0-2026-119710)
Vulnerability from nvd – Published: 2026-10-30 15:16 – Updated: 2026-10-30 15:41
VLAI
EPSS
VEX
Title
PipesHub 0.3.0 before 0.10.0 Connector Deletion via Crawling-Manager Schedule Route
Summary
PipesHub 0.3.0 before 0.10.0 contains an event type injection vulnerability that allows authenticated users with only the crawl:write scope to delete connectors by injecting into the :connector path segment. Attackers can send a :connector value like web.delete to the schedule route, bypassing connector:delete and lock checks to remove connector instances and purge record embeddings.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 15:40 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/pipeshub-ai/pipeshub-ai/securi… | vendor-advisory |
| https://github.com/pipeshub-ai/pipeshub-ai/commit… | patch |
| https://github.com/pipeshub-ai/pipeshub-ai/blob/v… | technical-description |
| https://github.com/pipeshub-ai/pipeshub-ai/releas… | release-notes |
| https://github.com/pipeshub-ai/pipeshub-ai | product |
| https://www.vulncheck.com/advisories/pipeshub-0.3… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pipeshub-ai | pipeshub-ai |
Affected:
0.3.0 , < 0.10.0
(semver)
cpe:2.3:a:pipeshub:pipeshub:*:*:*:*:*:*:*:* |
Date Public
2026-10-25 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119710",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T15:40:31.156155Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T15:41:02.299Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/pipeshub-ai/pipeshub-ai/security/advisories/GHSA-cwp5-6php-hrgx"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "pipeshub-ai",
"vendor": "pipeshub-ai",
"versions": [
{
"lessThan": "0.10.0",
"status": "affected",
"version": "0.3.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:pipeshub:pipeshub:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.10.0",
"versionStartIncluding": "0.3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hyderpwn"
}
],
"datePublic": "2026-10-25T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PipesHub 0.3.0 before 0.10.0 contains an event type injection vulnerability that allows authenticated users with only the crawl:write scope to delete connectors by injecting into the :connector path segment. Attackers can send a :connector value like web.delete to the schedule route, bypassing connector:delete and lock checks to remove connector instances and purge record embeddings."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T15:16:10.174Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-cwp5-6php-hrgx)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/pipeshub-ai/pipeshub-ai/security/advisories/GHSA-cwp5-6php-hrgx"
},
{
"tags": [
"patch"
],
"url": "https://github.com/pipeshub-ai/pipeshub-ai/commit/967232f4cb0fc2d0da5ebc30990417a349d6c56a"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pipeshub-ai/pipeshub-ai/blob/v0.9.1/backend/nodejs/apps/src/modules/crawling_manager/utils/utils.ts"
},
{
"name": "pipeshub-ai v0.10.0 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/pipeshub-ai/pipeshub-ai/releases/tag/v0.10.0"
},
{
"tags": [
"product"
],
"url": "https://github.com/pipeshub-ai/pipeshub-ai"
},
{
"name": "VulnCheck Advisory: PipesHub 0.3.0 before 0.10.0 Connector Deletion via Crawling-Manager Schedule Route",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pipeshub-0.3.0-before-0.10.0-connector-deletion-via-crawling-manager-schedule-route"
}
],
"title": "PipesHub 0.3.0 before 0.10.0 Connector Deletion via Crawling-Manager Schedule Route",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119710",
"datePublished": "2026-10-30T15:16:10.174Z",
"dateReserved": "2026-10-30T14:49:24.896Z",
"dateUpdated": "2026-10-30T15:41:02.299Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-67506 (GCVE-0-2025-67506)
Vulnerability from nvd – Published: 2025-12-10 00:36 – Updated: 2025-12-10 15:35
VLAI
EPSS
VEX
Title
PipesHub Vulnerable to Path Traversal through Unauthenticated Arbitrary File Upload
Summary
PipesHub is a fully extensible workplace AI platform for enterprise search and workflow automation. Versions prior to 0.1.0-beta expose POST /api/v1/record/buffer/convert through missing authentication. The endpoint accepts a file upload and converts it to PDF via LibreOffice by uploading payload to os.path.join(tmpdir, file.filename) without normalizing the filename. An attacker can submit a crafted filename containing ../ sequences to write arbitrary files anywhere the service account has permission, enabling remote file overwrite or planting malicious code. This issue is fixed in version 0.1.0-beta.
Severity
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-12-10 15:35 UTC
CWE
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/pipeshub-ai/pipeshub-ai/securi… | x_refsource_CONFIRM |
| https://github.com/pipeshub-ai/pipeshub-ai/commit… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pipeshub-ai | pipeshub-ai |
Affected:
< 0.1.0-beta
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-67506",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-12-10T15:35:23.052252Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-12-10T15:35:47.244Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "pipeshub-ai",
"vendor": "pipeshub-ai",
"versions": [
{
"status": "affected",
"version": "\u003c 0.1.0-beta"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "PipesHub is a fully extensible workplace AI platform for enterprise search and workflow automation. Versions prior to 0.1.0-beta expose POST /api/v1/record/buffer/convert through missing authentication. The endpoint accepts a file upload and converts it to PDF via LibreOffice by uploading payload to os.path.join(tmpdir, file.filename) without normalizing the filename. An attacker can submit a crafted filename containing ../ sequences to write arbitrary files anywhere the service account has permission, enabling remote file overwrite or planting malicious code. This issue is fixed in version 0.1.0-beta."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434: Unrestricted Upload of File with Dangerous Type",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-12-10T00:36:16.730Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/pipeshub-ai/pipeshub-ai/security/advisories/GHSA-w398-9m55-2357",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/pipeshub-ai/pipeshub-ai/security/advisories/GHSA-w398-9m55-2357"
},
{
"name": "https://github.com/pipeshub-ai/pipeshub-ai/commit/987ebab40a1fc39956730ed93220f7f9b2c4e5f8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pipeshub-ai/pipeshub-ai/commit/987ebab40a1fc39956730ed93220f7f9b2c4e5f8"
}
],
"source": {
"advisory": "GHSA-w398-9m55-2357",
"discovery": "UNKNOWN"
},
"title": "PipesHub Vulnerable to Path Traversal through Unauthenticated Arbitrary File Upload"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-67506",
"datePublished": "2025-12-10T00:36:16.730Z",
"dateReserved": "2025-12-08T21:36:28.780Z",
"dateUpdated": "2025-12-10T15:35:47.244Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119712 (GCVE-0-2026-119712)
Vulnerability from cvelistv5 – Published: 2026-10-30 15:16 – Updated: 2026-10-30 15:19
VLAI
EPSS
VEX
Title
PipesHub before 0.10.0 SSRF via Image URLs in Indexed Documents
Summary
PipesHub before 0.10.0 contains a server-side request forgery vulnerability in ImageParser._fetch_single_url that allows attackers to make the indexing service fetch internal addresses by embedding image URLs in documents. Attackers can supply Markdown or HTML via uploads, synced mailboxes, or web connectors to reach loopback, private-network, or cloud metadata endpoints, with image responses embedded into indexed content.
Severity
6.4 (Medium)
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/pipeshub-ai/pipeshub-ai/securi… | vendor-advisory |
| https://github.com/pipeshub-ai/pipeshub-ai/commit… | patch |
| https://github.com/pipeshub-ai/pipeshub-ai/blob/v… | technical-description |
| https://github.com/pipeshub-ai/pipeshub-ai/releas… | release-notes |
| https://github.com/pipeshub-ai/pipeshub-ai | product |
| https://www.vulncheck.com/advisories/pipeshub-bef… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pipeshub-ai | pipeshub-ai |
Affected:
0 , < 0.10.0
(semver)
cpe:2.3:a:pipeshub:pipeshub:*:*:*:*:*:*:*:* |
Date Public
2026-10-25 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "pipeshub-ai",
"vendor": "pipeshub-ai",
"versions": [
{
"lessThan": "0.10.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:pipeshub:pipeshub:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.10.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hyderpwn"
}
],
"datePublic": "2026-10-25T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PipesHub before 0.10.0 contains a server-side request forgery vulnerability in ImageParser._fetch_single_url that allows attackers to make the indexing service fetch internal addresses by embedding image URLs in documents. Attackers can supply Markdown or HTML via uploads, synced mailboxes, or web connectors to reach loopback, private-network, or cloud metadata endpoints, with image responses embedded into indexed content."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T15:19:20.964Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-mp2g-r37c-fx9q)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/pipeshub-ai/pipeshub-ai/security/advisories/GHSA-mp2g-r37c-fx9q"
},
{
"tags": [
"patch"
],
"url": "https://github.com/pipeshub-ai/pipeshub-ai/commit/16b05ed7c4c492330046fa10753389a5a5886613"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pipeshub-ai/pipeshub-ai/blob/v0.9.1/backend/python/app/modules/parsers/image_parser/image_parser.py"
},
{
"name": "pipeshub-ai v0.10.0 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/pipeshub-ai/pipeshub-ai/releases/tag/v0.10.0"
},
{
"tags": [
"product"
],
"url": "https://github.com/pipeshub-ai/pipeshub-ai"
},
{
"name": "VulnCheck Advisory: PipesHub before 0.10.0 SSRF via Image URLs in Indexed Documents",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pipeshub-before-0.10.0-ssrf-via-image-urls-in-indexed-documents"
}
],
"title": "PipesHub before 0.10.0 SSRF via Image URLs in Indexed Documents",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119712",
"datePublished": "2026-10-30T15:16:11.556Z",
"dateReserved": "2026-10-30T14:49:25.674Z",
"dateUpdated": "2026-10-30T15:19:20.964Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119711 (GCVE-0-2026-119711)
Vulnerability from cvelistv5 – Published: 2026-10-30 15:16 – Updated: 2026-10-30 15:16
VLAI
EPSS
VEX
Title
PipesHub before 0.10.0 Rate Limit Bypass via Spoofed X-Forwarded-For Header
Summary
PipesHub before 0.10.0 contains a rate limit bypass vulnerability in getClientIp() that allows unauthenticated attackers to evade per-IP throttling by spoofing X-Forwarded-For or X-Real-IP headers. Attackers can rotate header values to obtain fresh rate-limit buckets on authentication endpoints, enabling password spraying and OTP or password-reset email flooding.
Severity
5.3 (Medium)
CWE
- CWE-348 - Use of Less Trusted Source
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/pipeshub-ai/pipeshub-ai/securi… | vendor-advisory |
| https://github.com/pipeshub-ai/pipeshub-ai/commit… | patch |
| https://github.com/pipeshub-ai/pipeshub-ai/blob/v… | technical-description |
| https://github.com/pipeshub-ai/pipeshub-ai/releas… | release-notes |
| https://github.com/pipeshub-ai/pipeshub-ai | product |
| https://www.vulncheck.com/advisories/pipeshub-bef… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pipeshub-ai | pipeshub-ai |
Affected:
0 , < 0.10.0
(semver)
cpe:2.3:a:pipeshub:pipeshub:*:*:*:*:*:*:*:* |
Date Public
2026-10-25 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "pipeshub-ai",
"vendor": "pipeshub-ai",
"versions": [
{
"lessThan": "0.10.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:pipeshub:pipeshub:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.10.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hyderpwn"
}
],
"datePublic": "2026-10-25T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PipesHub before 0.10.0 contains a rate limit bypass vulnerability in getClientIp() that allows unauthenticated attackers to evade per-IP throttling by spoofing X-Forwarded-For or X-Real-IP headers. Attackers can rotate header values to obtain fresh rate-limit buckets on authentication endpoints, enabling password spraying and OTP or password-reset email flooding."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-348",
"description": "Use of Less Trusted Source",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T15:16:10.897Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-78gw-g2h7-xvjj)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/pipeshub-ai/pipeshub-ai/security/advisories/GHSA-78gw-g2h7-xvjj"
},
{
"tags": [
"patch"
],
"url": "https://github.com/pipeshub-ai/pipeshub-ai/commit/84614464bb120e9f8e8c85420001260e709d99bb"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pipeshub-ai/pipeshub-ai/blob/v0.9.1/backend/nodejs/apps/src/libs/middlewares/rate-limit.middleware.ts"
},
{
"name": "pipeshub-ai v0.10.0 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/pipeshub-ai/pipeshub-ai/releases/tag/v0.10.0"
},
{
"tags": [
"product"
],
"url": "https://github.com/pipeshub-ai/pipeshub-ai"
},
{
"name": "VulnCheck Advisory: PipesHub before 0.10.0 Rate Limit Bypass via Spoofed X-Forwarded-For Header",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pipeshub-before-0.10.0-rate-limit-bypass-via-spoofed-x-forwarded-for-header"
}
],
"title": "PipesHub before 0.10.0 Rate Limit Bypass via Spoofed X-Forwarded-For Header",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119711",
"datePublished": "2026-10-30T15:16:10.897Z",
"dateReserved": "2026-10-30T14:49:25.278Z",
"dateUpdated": "2026-10-30T15:16:10.897Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119710 (GCVE-0-2026-119710)
Vulnerability from cvelistv5 – Published: 2026-10-30 15:16 – Updated: 2026-10-30 15:41
VLAI
EPSS
VEX
Title
PipesHub 0.3.0 before 0.10.0 Connector Deletion via Crawling-Manager Schedule Route
Summary
PipesHub 0.3.0 before 0.10.0 contains an event type injection vulnerability that allows authenticated users with only the crawl:write scope to delete connectors by injecting into the :connector path segment. Attackers can send a :connector value like web.delete to the schedule route, bypassing connector:delete and lock checks to remove connector instances and purge record embeddings.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 15:40 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/pipeshub-ai/pipeshub-ai/securi… | vendor-advisory |
| https://github.com/pipeshub-ai/pipeshub-ai/commit… | patch |
| https://github.com/pipeshub-ai/pipeshub-ai/blob/v… | technical-description |
| https://github.com/pipeshub-ai/pipeshub-ai/releas… | release-notes |
| https://github.com/pipeshub-ai/pipeshub-ai | product |
| https://www.vulncheck.com/advisories/pipeshub-0.3… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pipeshub-ai | pipeshub-ai |
Affected:
0.3.0 , < 0.10.0
(semver)
cpe:2.3:a:pipeshub:pipeshub:*:*:*:*:*:*:*:* |
Date Public
2026-10-25 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119710",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T15:40:31.156155Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T15:41:02.299Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/pipeshub-ai/pipeshub-ai/security/advisories/GHSA-cwp5-6php-hrgx"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "pipeshub-ai",
"vendor": "pipeshub-ai",
"versions": [
{
"lessThan": "0.10.0",
"status": "affected",
"version": "0.3.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:pipeshub:pipeshub:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.10.0",
"versionStartIncluding": "0.3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hyderpwn"
}
],
"datePublic": "2026-10-25T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PipesHub 0.3.0 before 0.10.0 contains an event type injection vulnerability that allows authenticated users with only the crawl:write scope to delete connectors by injecting into the :connector path segment. Attackers can send a :connector value like web.delete to the schedule route, bypassing connector:delete and lock checks to remove connector instances and purge record embeddings."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T15:16:10.174Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-cwp5-6php-hrgx)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/pipeshub-ai/pipeshub-ai/security/advisories/GHSA-cwp5-6php-hrgx"
},
{
"tags": [
"patch"
],
"url": "https://github.com/pipeshub-ai/pipeshub-ai/commit/967232f4cb0fc2d0da5ebc30990417a349d6c56a"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pipeshub-ai/pipeshub-ai/blob/v0.9.1/backend/nodejs/apps/src/modules/crawling_manager/utils/utils.ts"
},
{
"name": "pipeshub-ai v0.10.0 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/pipeshub-ai/pipeshub-ai/releases/tag/v0.10.0"
},
{
"tags": [
"product"
],
"url": "https://github.com/pipeshub-ai/pipeshub-ai"
},
{
"name": "VulnCheck Advisory: PipesHub 0.3.0 before 0.10.0 Connector Deletion via Crawling-Manager Schedule Route",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pipeshub-0.3.0-before-0.10.0-connector-deletion-via-crawling-manager-schedule-route"
}
],
"title": "PipesHub 0.3.0 before 0.10.0 Connector Deletion via Crawling-Manager Schedule Route",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119710",
"datePublished": "2026-10-30T15:16:10.174Z",
"dateReserved": "2026-10-30T14:49:24.896Z",
"dateUpdated": "2026-10-30T15:41:02.299Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-67506 (GCVE-0-2025-67506)
Vulnerability from cvelistv5 – Published: 2025-12-10 00:36 – Updated: 2025-12-10 15:35
VLAI
EPSS
VEX
Title
PipesHub Vulnerable to Path Traversal through Unauthenticated Arbitrary File Upload
Summary
PipesHub is a fully extensible workplace AI platform for enterprise search and workflow automation. Versions prior to 0.1.0-beta expose POST /api/v1/record/buffer/convert through missing authentication. The endpoint accepts a file upload and converts it to PDF via LibreOffice by uploading payload to os.path.join(tmpdir, file.filename) without normalizing the filename. An attacker can submit a crafted filename containing ../ sequences to write arbitrary files anywhere the service account has permission, enabling remote file overwrite or planting malicious code. This issue is fixed in version 0.1.0-beta.
Severity
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-12-10 15:35 UTC
CWE
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/pipeshub-ai/pipeshub-ai/securi… | x_refsource_CONFIRM |
| https://github.com/pipeshub-ai/pipeshub-ai/commit… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pipeshub-ai | pipeshub-ai |
Affected:
< 0.1.0-beta
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-67506",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-12-10T15:35:23.052252Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-12-10T15:35:47.244Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "pipeshub-ai",
"vendor": "pipeshub-ai",
"versions": [
{
"status": "affected",
"version": "\u003c 0.1.0-beta"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "PipesHub is a fully extensible workplace AI platform for enterprise search and workflow automation. Versions prior to 0.1.0-beta expose POST /api/v1/record/buffer/convert through missing authentication. The endpoint accepts a file upload and converts it to PDF via LibreOffice by uploading payload to os.path.join(tmpdir, file.filename) without normalizing the filename. An attacker can submit a crafted filename containing ../ sequences to write arbitrary files anywhere the service account has permission, enabling remote file overwrite or planting malicious code. This issue is fixed in version 0.1.0-beta."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434: Unrestricted Upload of File with Dangerous Type",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-12-10T00:36:16.730Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/pipeshub-ai/pipeshub-ai/security/advisories/GHSA-w398-9m55-2357",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/pipeshub-ai/pipeshub-ai/security/advisories/GHSA-w398-9m55-2357"
},
{
"name": "https://github.com/pipeshub-ai/pipeshub-ai/commit/987ebab40a1fc39956730ed93220f7f9b2c4e5f8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pipeshub-ai/pipeshub-ai/commit/987ebab40a1fc39956730ed93220f7f9b2c4e5f8"
}
],
"source": {
"advisory": "GHSA-w398-9m55-2357",
"discovery": "UNKNOWN"
},
"title": "PipesHub Vulnerable to Path Traversal through Unauthenticated Arbitrary File Upload"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-67506",
"datePublished": "2025-12-10T00:36:16.730Z",
"dateReserved": "2025-12-08T21:36:28.780Z",
"dateUpdated": "2025-12-10T15:35:47.244Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}