CVE-2026-69160 (GCVE-0-2026-69160)
Vulnerability from cvelistv5 – Published: 2026-08-18 18:04 – Updated: 2026-08-18 18:47
VLAI
EPSS
VEX
Title
OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation API
Summary
OpenList a file list program that supports multiple storage. Prior to 4.2.4, the share creation and update checks in server/handles/sharing.go use strings.HasPrefix(requested_path, user.BasePath) without enforcing a directory separator boundary. An authenticated user with CanShare permission and a BasePath such as /base can submit a sibling path such as /base2/secret.txt, create a share for the out-of-scope file, and use the public share download or list handlers to read data outside the assigned directory. This issue is fixed in version 4.2.4.
Severity
6.5 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-18 18:47 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/OpenListTeam/OpenList/security… | x_refsource_CONFIRM |
| https://github.com/OpenListTeam/OpenList/commit/5… | x_refsource_MISC |
| https://github.com/OpenListTeam/OpenList/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| OpenListTeam | OpenList |
Affected:
< 4.2.4
|
guessed |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-69160",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-18T18:47:00.366637Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T18:47:07.385Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-86cx-wwf4-phq4"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "OpenList",
"vendor": "OpenListTeam",
"versions": [
{
"status": "affected",
"version": "\u003c 4.2.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenList a file list program that supports multiple storage. Prior to 4.2.4, the share creation and update checks in server/handles/sharing.go use strings.HasPrefix(requested_path, user.BasePath) without enforcing a directory separator boundary. An authenticated user with CanShare permission and a BasePath such as /base can submit a sibling path such as /base2/secret.txt, create a share for the out-of-scope file, and use the public share download or list handlers to read data outside the assigned directory. This issue is fixed in version 4.2.4."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T18:04:42.070Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-86cx-wwf4-phq4",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-86cx-wwf4-phq4"
},
{
"name": "https://github.com/OpenListTeam/OpenList/commit/59bd3431408578f420895457554700cc9a52375a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OpenListTeam/OpenList/commit/59bd3431408578f420895457554700cc9a52375a"
},
{
"name": "https://github.com/OpenListTeam/OpenList/releases/tag/v4.2.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OpenListTeam/OpenList/releases/tag/v4.2.4"
}
],
"source": {
"advisory": "GHSA-86cx-wwf4-phq4",
"discovery": "UNKNOWN"
},
"title": "OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation API"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-69160",
"datePublished": "2026-08-18T18:04:42.070Z",
"dateReserved": "2026-08-03T15:47:09.655Z",
"dateUpdated": "2026-08-18T18:47:07.385Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-69160",
"date": "2026-10-14",
"epss": "0.00402",
"percentile": "0.32726"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"product": "OpenList",
"vendor": "OpenListTeam",
"versions": [
{
"status": "affected",
"version": "\u003c 4.2.4"
}
]
}
],
"source": "security-advisories@github.com"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "OpenList a file list program that supports multiple storage. Prior to 4.2.4, the share creation and update checks in server/handles/sharing.go use strings.HasPrefix(requested_path, user.BasePath) without enforcing a directory separator boundary. An authenticated user with CanShare permission and a BasePath such as /base can submit a sibling path such as /base2/secret.txt, create a share for the out-of-scope file, and use the public share download or list handlers to read data outside the assigned directory. This issue is fixed in version 4.2.4."
}
],
"id": "CVE-2026-69160",
"lastModified": "2026-09-18T20:09:01.757",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6,
"source": "security-advisories@github.com",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-69160",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-18T18:47:00.366637Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-08-18T18:19:28.493",
"references": [
{
"source": "security-advisories@github.com",
"url": "https://github.com/OpenListTeam/OpenList/commit/59bd3431408578f420895457554700cc9a52375a"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/OpenListTeam/OpenList/releases/tag/v4.2.4"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-86cx-wwf4-phq4"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"url": "https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-86cx-wwf4-phq4"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-639"
}
],
"source": "security-advisories@github.com",
"type": "Secondary"
}
]
}
},
"vulnrichment": {
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-69160",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-18T18:47:00.366637Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T18:46:44.723Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-86cx-wwf4-phq4"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "OpenList",
"vendor": "OpenListTeam",
"versions": [
{
"status": "affected",
"version": "\u003c 4.2.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenList a file list program that supports multiple storage. Prior to 4.2.4, the share creation and update checks in server/handles/sharing.go use strings.HasPrefix(requested_path, user.BasePath) without enforcing a directory separator boundary. An authenticated user with CanShare permission and a BasePath such as /base can submit a sibling path such as /base2/secret.txt, create a share for the out-of-scope file, and use the public share download or list handlers to read data outside the assigned directory. This issue is fixed in version 4.2.4."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T18:04:42.070Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-86cx-wwf4-phq4",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-86cx-wwf4-phq4"
},
{
"name": "https://github.com/OpenListTeam/OpenList/commit/59bd3431408578f420895457554700cc9a52375a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OpenListTeam/OpenList/commit/59bd3431408578f420895457554700cc9a52375a"
},
{
"name": "https://github.com/OpenListTeam/OpenList/releases/tag/v4.2.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OpenListTeam/OpenList/releases/tag/v4.2.4"
}
],
"source": {
"advisory": "GHSA-86cx-wwf4-phq4",
"discovery": "UNKNOWN"
},
"title": "OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation API"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-69160",
"datePublished": "2026-08-18T18:04:42.070Z",
"dateReserved": "2026-08-03T15:47:09.655Z",
"dateUpdated": "2026-08-18T18:47:07.385Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
FKIE_CVE-2026-69160
Vulnerability from fkie_nvd - Published: 2026-08-18 18:19 - Updated: 2026-09-18 20:09
Severity
Summary
OpenList a file list program that supports multiple storage. Prior to 4.2.4, the share creation and update checks in server/handles/sharing.go use strings.HasPrefix(requested_path, user.BasePath) without enforcing a directory separator boundary. An authenticated user with CanShare permission and a BasePath such as /base can submit a sibling path such as /base2/secret.txt, create a share for the out-of-scope file, and use the public share download or list handlers to read data outside the assigned directory. This issue is fixed in version 4.2.4.
References
Impacted products
| Vendor | Product | Version |
|---|
{
"affected": [
{
"affectedData": [
{
"product": "OpenList",
"vendor": "OpenListTeam",
"versions": [
{
"status": "affected",
"version": "\u003c 4.2.4"
}
]
}
],
"source": "security-advisories@github.com"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "OpenList a file list program that supports multiple storage. Prior to 4.2.4, the share creation and update checks in server/handles/sharing.go use strings.HasPrefix(requested_path, user.BasePath) without enforcing a directory separator boundary. An authenticated user with CanShare permission and a BasePath such as /base can submit a sibling path such as /base2/secret.txt, create a share for the out-of-scope file, and use the public share download or list handlers to read data outside the assigned directory. This issue is fixed in version 4.2.4."
}
],
"id": "CVE-2026-69160",
"lastModified": "2026-09-18T20:09:01.757",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6,
"source": "security-advisories@github.com",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-69160",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-18T18:47:00.366637Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-08-18T18:19:28.493",
"references": [
{
"source": "security-advisories@github.com",
"url": "https://github.com/OpenListTeam/OpenList/commit/59bd3431408578f420895457554700cc9a52375a"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/OpenListTeam/OpenList/releases/tag/v4.2.4"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-86cx-wwf4-phq4"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"url": "https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-86cx-wwf4-phq4"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-639"
}
],
"source": "security-advisories@github.com",
"type": "Secondary"
}
]
}
GHSA-86CX-WWF4-PHQ4
Vulnerability from github – Published: 2026-07-24 22:32 – Updated: 2026-08-18 18:04
VLAI
Summary
OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation API
Details
Summary
An authorization bypass vulnerability exists in the file sharing mechanism of Openlist. Due to a flawed, non-separator-aware path validation check, an authenticated user can create share links for files outside their restricted base directory. This allows an attacker to bypass tenant/user isolation and gain unauthorized read access to arbitrary files within the system.
Details
When a user attempts to create or update a file share, the application must verify that the requested file path falls within the user's assigned BasePath. However, in server/handles/sharing.go, this authorization check relies on a simple string prefix function: strings.HasPrefix(requested_path, user.BasePath).
Because strings.HasPrefix does not account for directory separators (e.g., /), an attacker whose BasePath is assigned to /base can supply a target path like /base2/secret_document.txt. The validation strings.HasPrefix("/base2/secret_document.txt", "/base") evaluates to true, successfully passing the authorization filter.
Once the share is created, the public share download/list handlers unwrap and serve the file based on the stored absolute path without re-verifying the creator's current directory scope, granting the attacker horizontal access to unauthorized data.
PoC
Prerequisites:
1. A system with at least two distinct directories at the root level: /base and /base2.
2. A sensitive file exists at /base2/secret.txt.
3. An attacker account with the CanShare permission enabled and its Base path strictly limited to /base.
Exploitation Steps:
1. Log in as the attacker account and obtain the JWT authorization token.
2. Send a POST request to create a new share, intentionally targeting the unauthorized sibling directory /base2:
POST /api/share/create HTTP/1.1
Host: <your-openlist-host>
Authorization: <attacker-jwt-token>
Content-Type: application/json
{
"files": ["/base2/secret.txt"],
"pwd": "",
"max_accessed": 0
}
Observe the bypass: The API accepts the request and responds with a successful share creation message, returning a share_id.
The attacker can now access the public share endpoint (e.g., via the web UI or API /api/fs/list / /sd/<share-id>/...) to download or view /base2/secret.txt, completely bypassing their directory restrictions.
Impact
This is a High-severity Horizontal and Vertical Privilege Escalation vulnerability. A malicious user with basic sharing privileges can weaponize this path confusion to expose, read, and download any file from other users' directories or internal application paths, provided the target path shares the same string prefix as their own directory. This completely breaks the data isolation guarantees of the application.
Remediation Recommendations
Canonical Path Containment: Replace the raw strings.HasPrefix check with a robust, separator-aware path containment validation. Ensure both paths are normalized, and use logic such as: target == base || strings.HasPrefix(target, base + "/").
Centralized Validation Utility: Implement a dedicated function (e.g., utils.IsSubPath(base, target)) and apply it consistently across share creation, updating, and viewing handlers to prevent regressions.
Credits
- Thai Son Dinh from VinSOC Labs (R&D)
Severity
6.5 (Medium)
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 4.2.3"
},
"package": {
"ecosystem": "Go",
"name": "github.com/OpenListTeam/OpenList/v4"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.2.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-69160"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-24T22:32:37Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Summary\nAn authorization bypass vulnerability exists in the file sharing mechanism of `Openlist`. Due to a flawed, non-separator-aware path validation check, an authenticated user can create share links for files outside their restricted base directory. This allows an attacker to bypass tenant/user isolation and gain unauthorized read access to arbitrary files within the system.\n\n### Details\nWhen a user attempts to create or update a file share, the application must verify that the requested file path falls within the user\u0027s assigned `BasePath`. However, in `server/handles/sharing.go`, this authorization check relies on a simple string prefix function: `strings.HasPrefix(requested_path, user.BasePath)`.\n\nBecause `strings.HasPrefix` does not account for directory separators (e.g., `/`), an attacker whose `BasePath` is assigned to `/base` can supply a target path like `/base2/secret_document.txt`. The validation `strings.HasPrefix(\"/base2/secret_document.txt\", \"/base\")` evaluates to `true`, successfully passing the authorization filter. \n\nOnce the share is created, the public share download/list handlers unwrap and serve the file based on the stored absolute path without re-verifying the creator\u0027s current directory scope, granting the attacker horizontal access to unauthorized data.\n\n### PoC\n**Prerequisites:**\n1. A system with at least two distinct directories at the root level: `/base` and `/base2`.\n2. A sensitive file exists at `/base2/secret.txt`.\n3. An attacker account with the `CanShare` permission enabled and its `Base path` strictly limited to `/base`.\n\n**Exploitation Steps:**\n1. Log in as the attacker account and obtain the JWT authorization token.\n2. Send a `POST` request to create a new share, intentionally targeting the unauthorized sibling directory `/base2`:\n\n```http\nPOST /api/share/create HTTP/1.1\nHost: \u003cyour-openlist-host\u003e\nAuthorization: \u003cattacker-jwt-token\u003e\nContent-Type: application/json\n\n{\n \"files\": [\"/base2/secret.txt\"],\n \"pwd\": \"\",\n \"max_accessed\": 0\n}\n```\nObserve the bypass: The API accepts the request and responds with a successful share creation message, returning a `share_id`.\n\nThe attacker can now access the public share endpoint (e.g., via the web UI or API `/api/fs/list` / `/sd/\u003cshare-id\u003e/...`) to download or view `/base2/secret.txt`, completely bypassing their directory restrictions.\n\n\u003cimg width=\"2457\" height=\"1307\" alt=\"7b0bd29c9d12ad0b7b84a4a156559a5b\" src=\"https://github.com/user-attachments/assets/415e4915-dbc2-4738-8c53-8174998b42a9\" /\u003e\n\n\u003cimg width=\"1937\" height=\"856\" alt=\"90b16bf15b6e8bfb87f16c4ab8864ea7\" src=\"https://github.com/user-attachments/assets/8dc5205e-2ac6-4f4f-9d40-e1e9d72229d5\" /\u003e\n\n### Impact\nThis is a High-severity Horizontal and Vertical Privilege Escalation vulnerability. A malicious user with basic sharing privileges can weaponize this path confusion to expose, read, and download any file from other users\u0027 directories or internal application paths, provided the target path shares the same string prefix as their own directory. This completely breaks the data isolation guarantees of the application.\n\n### Remediation Recommendations\nCanonical Path Containment: Replace the raw `strings.HasPrefix` check with a robust, separator-aware path containment validation. Ensure both paths are normalized, and use logic such as: `target == base || strings.HasPrefix(target, base + \"/\")`.\n\nCentralized Validation Utility: Implement a dedicated function (e.g., `utils.IsSubPath(base, target)`) and apply it consistently across share creation, updating, and viewing handlers to prevent regressions.\n\n### Credits\n- Thai Son Dinh from VinSOC Labs (R\u0026D)",
"id": "GHSA-86cx-wwf4-phq4",
"modified": "2026-08-18T18:04:49Z",
"published": "2026-07-24T22:32:37Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-86cx-wwf4-phq4"
},
{
"type": "WEB",
"url": "https://github.com/OpenListTeam/OpenList/commit/59bd3431408578f420895457554700cc9a52375a"
},
{
"type": "PACKAGE",
"url": "https://github.com/OpenListTeam/OpenList"
},
{
"type": "WEB",
"url": "https://github.com/OpenListTeam/OpenList/releases/tag/v4.2.4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation API"
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.