GCVE-1988-2026-0485

Vulnerability from gna-1988 – Published: 2026-11-02 07:30 – Updated: 2026-11-02 07:30
VLAI
Title
[0day-rubbish] CloudPanel 2.5.4-3 site-settings rootDirectory nginx virtual-host injection to host root code execution (8.8)
Summary
0day Rubbish Research Team is publicly disclosing a vulnerability in CloudPanel Community Edition 2.5.4-3+clp-bookworm, the closed-source server-management panel from cloudpanel.io (Germany) that provisions and supervises nginx, php-fpm, MariaDB and hosted web sites from a Symfony application listening on port 8443. The build under advisory is the vendor's own distribution package, 69,183,476 bytes, md5 24c36a4739ce065c5c188c89def06f29, on Debian bookworm x86_64. Only this build was tested; no other version, edition or deployment target is claimed, in either direction. Type: injection of control characters into a configuration file that a second parser then reads as syntax, CWE-93 primary, with CWE-20, CWE-74 and CWE-269 / CWE-250 contributing. This is not command injection and we do not classify it as CWE-78: the writer that puts the text on disk is `echo %s | /usr/bin/sudo /usr/bin/tee %s` with both substitutions passed through `escapeshellarg`, so the newlines travel inside a single-quoted shell argument as data and no shell metacharacter reaches a command line. The sink is the virtual-host renderer. `RootDirectory.php` owns the `{{root}}` placeholder and composes it at label `b9892` as `rtrim(sprintf("root /home/%s/htdocs/%s;", $siteUser, $rootDirectory), "/")`. That `rtrim` is dead code, because the format string always ends with a semicolon and so its result can never end with a slash. Between the value entering the method and being composed into a directive there is no call of any kind - no `basename`, no `realpath`, no `preg_match`, no allowlist, no blacklist, no length check, no character check. The database value is the concatenated value. The attacker therefore does not control the `root` directive's value but its tail, which is sufficient: a leading semicolon terminates the already-started directive cleanly and the injected blocks that follow land at server context ahead of the template's own `location` blocks, where the `^~` prefix match outranks regex locations. `{{root}}` appears twice in the hosting template, so the payload is inserted twice, once per server block, which is consistent with the observed file growth. The double standard is the useful part for anyone auditing a similar form. The same form family validates the domain name with a dedicated constraint whose pattern excludes `/` and `\`; the command-line channel clamps the identical root-directory value with `ltrim(rtrim($x,"/"),"/")`; and a neighbouring free-text field on the same page has a four-step pre-submit normalization that rewrites double quotes to single ones. The web-channel `rootDirectory` value passes through none of these. Its only declared constraint is a not-null check, and its entity setter performs no sanitization. What turns a configuration write into host-root execution is vendor packaging, not attacker choice. The vendor's own `nginx-common 1.30.4-1+clp-bookworm` ships an `/etc/nginx/nginx.conf` whose line 1 is literally `user root;` and whose line 119 is `include /etc/nginx/sites-enabled/*.conf;` (md5 6727bffeb96cb3e03b85d00eac39c47c, 3,077 bytes, taken from the package payload rather than transcribed from a note). The same package ships `/home/clp/services/php-fpm/fpm/pool.d/file-manager.conf` declaring `user = root` and `group = clp` on `/run/clp-fm-php-fpm.sock`, with no `php_admin_value`, no `open_basedir`, no `disable_functions` and no `security.limit_extensions` anywhere in its seventeen lines. So an injected block carrying `dav_methods PUT; create_full_put_path on; alias /tmp/;` yields an anonymous WebDAV write primitive, and a second injected block carrying `root /tmp; include /etc/nginx/fastcgi_params; fastcgi_pass unix:/run/clp-fm-php-fpm.sock;` hands anonymous PHP execution to a pool that runs as root. The identity reached is host `uid=0(root) gid=1000(clp) groups=1000(clp),0(root)`, corroborated in the same response body by `posix_getuid()` and `posix_geteuid()` returning 0, by `whoami` returning `root`, by the uploaded file landing as `-rw------- 1 root root`, and by a filesystem-type read showing the marker landed on durable overlay storage rather than tmpfs. The exact shape of that identity string matters and it is not decoration: `id` run from outside the container prints `gid=0(root) groups=0(root)`, and a pool declaring only `user = root` would print the same, so the `gid=1000(clp) groups=1000(clp),0(root)` that came back over HTTP can only have been produced by the product's own execution path through a pool declaring `user = root; group = clp;`. Labelled honestly, that is a morphological inference from verbatim strings in two independent rounds plus a packaged pool file whose bytes are on record; the reviewing pass did not itself start a File Manager pool to observe the shape directly. Confirmation and what was deliberately not reproduced. The save answers 302 with no error text, and the product cannot report failure at all, because its reload success check returns true unconditionally and the reload is backgrounded. So the proof channel is the two anonymous requests plus the marker body, and four requirements were defined in advance and checked in every round: a live `id` containing `uid=0(root)` with no uid hardcoded in the uploaded script; device self-attestation values in the body that are absent from our own payload and our own script, with a positive control proving the search works and with two witnesses downgraded honestly (the boot identifier is shared across containers on one host kernel and the application secret is a factory constant, so the genuinely device-unique witness is the container hostname, differing between the two sets and independently embedded by `uname`); a fresh nonce per round appearing simultaneously in the uploaded filename, in a comment line inside the written virtual host and in the marker body, paired with the post-reload digest of that specific file and a per-nonce `nginx -T` hit count that goes 0 to 1 for the current round and back to 0 for the previous one; and evidence being response-body content and size, never a status code, since 201 and 200 both occurred in failed rounds too. Deliberately not reproduced, and not claimed: cross-tenant impact, because no second tenant was present; whether an illegal payload is rolled back under vendor-native wiring, since both native sets used legal payloads and the no-rollback behaviour was measured only under harness wiring; where injected text lands in the PHP-site template, because that template is not in the package at all and is imported at install time by a `git clone` of an external repository into a database column; the second injection point of the same shape feeding the `{{settings}}` placeholder, which static analysis says has the same exposure but for which no dynamic round was run and no control was constructed; and whether a local console invocation of the same sink, which the sudoers drop-in grants to any local user, can inject this field. One measured anomaly carries no established mechanism either: when the injected block omits the fastcgi parameter include the execution leg returns a silent zero-byte body, the phenomenon was observed twice, and two proposed mechanisms were both contradicted by the logs. Scoring. One score is published: 8.8 High, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, derived from first principles - ISS 0.914816, Unchanged impact 5.873119, exploitability 2.835255, base 8.708374, ceiling-to-tenth Roundup 8.8. No correction to any recorded score is needed. No conditional or higher reading is published: we identified no deployment state that makes this chain unauthenticated, and publishing a hypothetical PR:N figure conditioned on an unproven bypass would be inventing severity. Privileges Required is the metric worth arguing hardest, so both directions are given. It is PR:L and not PR:N, because no anonymous path reaches this sink: the catch-all access-control rule requires full authentication, twelve URI-mismatch variants against one protected route produced zero admissions, the anonymous identity-swap primitive described below yields an identity with zero additional capability confined to a route space that does not exist, and there is no factory credential to use since the product ships with zero users. It is not PR:H, because ROLE_ADMIN was never required - the settings page is not under `^/admin`, the handler declares `ROLE_USER` exactly once, and the injection was performed with `ROLE_USER` sessions and observed to take effect. Had only an administrator been demonstrated, the correct metric would be High and the same impact weights would produce 7.2, so getting this one metric wrong moves the score by 1.6 points. Scope: Unchanged, and this is the reading a triage process will question first, because the outcome is host uid=0 on a multi-tenant hosting panel. The temptation to publish Changed is genuine and we state it accurately rather than dismissing it: the vulnerable component is the panel application authorised to a tenant role, while the achieved impact lands on the host operating system and, in a multi-tenant deployment, on every other tenant's site - components outside the panel's own authorisation boundary, impacted in their own right, by an action authorised as "a tenant edits a setting on their own site". That is the textbook argument for Changed and it is not strained. We publish Unchanged for three reasons in increasing order of weight. First, the privilege ceiling is produced entirely by the vendor's own shipped configuration - `user root;` in the vendor nginx build, `user = root` in the vendor File Manager pool, and `clp ALL=(ALL) NOPASSWD: ALL` in the vendor sudoers drop-in - so every step of the escalation is performed by a component the product itself installed, configured and invoked, and the product is the authority at each step. No second product's exposed interface is being reached through the first product's flaw; what is reached is the host, through identities the product established. Second, the cross-tenant consequence is a capability inference and not a measurement: we did not run the verification on a host with a second tenant installed and we measured no impact on another tenant, and publishing Scope Changed on an untested cross-tenant claim is precisely the class of overreach that produces public corrections. Third, the conservative value already communicates the finding - 8.8 High reads as remote authenticated host-root code execution to every triage process that consumes it, so nothing decision-relevant is lost by declining the upgrade. The Changed-scope form of the same facts, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, is recorded in the analysis as a rejected reading: it is not published as a headline and no number is attached to it. If a triage process or an identifier-assigning authority prefers the Changed reading on the grounds that a tenant-scope authorisation boundary is crossed to affect the host and other tenants, the argument above is the complete case for it and the only missing evidence is a two-tenant measurement. Authentication: post-authentication, lowest panel role. Sessions are ordinary Symfony sessions issued by a login POST carrying `userName`, `password` and `_csrf_token`. The site-settings page is not under `^/admin`, so it falls to the catch-all rule requiring full authentication; the singular `role:` key in that rule is valid rather than a silent typo, because the framework's configuration normalization folds it into the plural form, and the dynamic proof that the catch-all is live is that an anonymous request for a deliberately nonexistent path returns 302 to the login page rather than 404, meaning the access-control check fires before route resolution. Fourteen sampled protected paths all redirected, and twelve URI-mismatch variants - trailing slash, doubled slash, encoded slash, matrix-semicolon path parameter, dot segments, percent-encoded letters, a null byte, upper-
Severity
No CVSS data available.
CWE
Assigner
VULNARCHIVE GNA GNA-1988
GNA scorecard E 38/100 over 556 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Mgt Commerce Cloudpanel Affected: unknown
guessed Create a notification for this product.
Credits
disclosure via Fulldisclosure
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Cloudpanel",
          "vendor": "Mgt Commerce",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in CloudPanel\nCommunity Edition 2.5.4-3+clp-bookworm, the closed-source server-management panel\nfrom cloudpanel.io (Germany) that provisions and supervises nginx, php-fpm,\nMariaDB and hosted web sites from a Symfony application listening on port 8443.\nThe build under advisory is the vendor\u0027s own distribution package, 69,183,476\nbytes, md5 24c36a4739ce065c5c188c89def06f29, on Debian bookworm x86_64. Only\nthis build was tested; no other version, edition or deployment target is\nclaimed, in either direction.\n\nType: injection of control characters into a configuration file that a second\nparser then reads as syntax, CWE-93 primary, with CWE-20, CWE-74 and CWE-269 /\nCWE-250 contributing. This is not command injection and we do not classify it as\nCWE-78: the writer that puts the text on disk is\n`echo %s | /usr/bin/sudo /usr/bin/tee %s` with both substitutions passed through\n`escapeshellarg`, so the newlines travel inside a single-quoted shell argument as\ndata and no shell metacharacter reaches a command line. The sink is the virtual-host\nrenderer. `RootDirectory.php` owns the `{{root}}` placeholder and composes it at\nlabel `b9892` as\n`rtrim(sprintf(\"root /home/%s/htdocs/%s;\", $siteUser, $rootDirectory), \"/\")`.\nThat `rtrim` is dead code, because the format string always ends with a semicolon\nand so its result can never end with a slash. Between the value entering the\nmethod and being composed into a directive there is no call of any kind - no\n`basename`, no `realpath`, no `preg_match`, no allowlist, no blacklist, no length\ncheck, no character check. The database value is the concatenated value. The\nattacker therefore does not control the `root` directive\u0027s value but its tail,\nwhich is sufficient: a leading semicolon terminates the already-started directive\ncleanly and the injected blocks that follow land at server context ahead of the\ntemplate\u0027s own `location` blocks, where the `^~` prefix match outranks regex\nlocations. `{{root}}` appears twice in the hosting template, so the payload is\ninserted twice, once per server block, which is consistent with the observed\nfile growth.\n\nThe double standard is the useful part for anyone auditing a similar form. The\nsame form family validates the domain name with a dedicated constraint whose\npattern excludes `/` and `\\`; the command-line channel clamps the identical\nroot-directory value with `ltrim(rtrim($x,\"/\"),\"/\")`; and a neighbouring\nfree-text field on the same page has a four-step pre-submit normalization that\nrewrites double quotes to single ones. The web-channel `rootDirectory` value\npasses through none of these. Its only declared constraint is a not-null check,\nand its entity setter performs no sanitization.\n\nWhat turns a configuration write into host-root execution is vendor packaging,\nnot attacker choice. The vendor\u0027s own `nginx-common 1.30.4-1+clp-bookworm` ships\nan `/etc/nginx/nginx.conf` whose line 1 is literally `user root;` and whose line\n119 is `include /etc/nginx/sites-enabled/*.conf;` (md5\n6727bffeb96cb3e03b85d00eac39c47c, 3,077 bytes, taken from the package payload\nrather than transcribed from a note). The same package ships\n`/home/clp/services/php-fpm/fpm/pool.d/file-manager.conf` declaring\n`user = root` and `group = clp` on `/run/clp-fm-php-fpm.sock`, with no\n`php_admin_value`, no `open_basedir`, no `disable_functions` and no\n`security.limit_extensions` anywhere in its seventeen lines. So an injected\nblock carrying `dav_methods PUT; create_full_put_path on; alias /tmp/;` yields an\nanonymous WebDAV write primitive, and a second injected block carrying\n`root /tmp; include /etc/nginx/fastcgi_params; fastcgi_pass unix:/run/clp-fm-php-fpm.sock;`\nhands anonymous PHP execution to a pool that runs as root.\n\nThe identity reached is host `uid=0(root) gid=1000(clp) groups=1000(clp),0(root)`,\ncorroborated in the same response body by `posix_getuid()` and `posix_geteuid()`\nreturning 0, by `whoami` returning `root`, by the uploaded file landing as\n`-rw------- 1 root root`, and by a filesystem-type read showing the marker landed\non durable overlay storage rather than tmpfs. The exact shape of that identity\nstring matters and it is not decoration: `id` run from outside the container\nprints `gid=0(root) groups=0(root)`, and a pool declaring only `user = root`\nwould print the same, so the `gid=1000(clp) groups=1000(clp),0(root)` that came\nback over HTTP can only have been produced by the product\u0027s own execution path\nthrough a pool declaring `user = root; group = clp;`. Labelled honestly, that is\na morphological inference from verbatim strings in two independent rounds plus a\npackaged pool file whose bytes are on record; the reviewing pass did not itself\nstart a File Manager pool to observe the shape directly.\n\nConfirmation and what was deliberately not reproduced. The save answers 302 with\nno error text, and the product cannot report failure at all, because its reload\nsuccess check returns true unconditionally and the reload is backgrounded. So the\nproof channel is the two anonymous requests plus the marker body, and four\nrequirements were defined in advance and checked in every round: a live `id`\ncontaining `uid=0(root)` with no uid hardcoded in the uploaded script; device\nself-attestation values in the body that are absent from our own payload and our\nown script, with a positive control proving the search works and with two\nwitnesses downgraded honestly (the boot identifier is shared across containers on\none host kernel and the application secret is a factory constant, so the genuinely\ndevice-unique witness is the container hostname, differing between the two sets\nand independently embedded by `uname`); a fresh nonce per round appearing\nsimultaneously in the uploaded filename, in a comment line inside the written\nvirtual host and in the marker body, paired with the post-reload digest of that\nspecific file and a per-nonce `nginx -T` hit count that goes 0 to 1 for the\ncurrent round and back to 0 for the previous one; and evidence being response-body\ncontent and size, never a status code, since 201 and 200 both occurred in failed\nrounds too.\n\nDeliberately not reproduced, and not claimed: cross-tenant impact, because no\nsecond tenant was present; whether an illegal payload is rolled back under\nvendor-native wiring, since both native sets used legal payloads and the\nno-rollback behaviour was measured only under harness wiring; where injected text\nlands in the PHP-site template, because that template is not in the package at all\nand is imported at install time by a `git clone` of an external repository into a\ndatabase column; the second injection point of the same shape feeding the\n`{{settings}}` placeholder, which static analysis says has the same exposure but\nfor which no dynamic round was run and no control was constructed; and whether a\nlocal console invocation of the same sink, which the sudoers drop-in grants to any\nlocal user, can inject this field. One measured anomaly carries no established\nmechanism either: when the injected block omits the fastcgi parameter include the\nexecution leg returns a silent zero-byte body, the phenomenon was observed twice,\nand two proposed mechanisms were both contradicted by the logs.\n\nScoring. One score is published: 8.8 High,\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, derived from first principles - ISS\n0.914816, Unchanged impact 5.873119, exploitability 2.835255, base 8.708374,\nceiling-to-tenth Roundup 8.8. No correction to any recorded score is needed. No\nconditional or higher reading is published: we identified no deployment state that\nmakes this chain unauthenticated, and publishing a hypothetical PR:N figure\nconditioned on an unproven bypass would be inventing severity.\n\nPrivileges Required is the metric worth arguing hardest, so both directions are\ngiven. It is PR:L and not PR:N, because no anonymous path reaches this sink: the\ncatch-all access-control rule requires full authentication, twelve URI-mismatch\nvariants against one protected route produced zero admissions, the anonymous\nidentity-swap primitive described below yields an identity with zero additional\ncapability confined to a route space that does not exist, and there is no factory\ncredential to use since the product ships with zero users. It is not PR:H, because\nROLE_ADMIN was never required - the settings page is not under `^/admin`, the\nhandler declares `ROLE_USER` exactly once, and the injection was performed with\n`ROLE_USER` sessions and observed to take effect. Had only an administrator been\ndemonstrated, the correct metric would be High and the same impact weights would\nproduce 7.2, so getting this one metric wrong moves the score by 1.6 points.\n\nScope: Unchanged, and this is the reading a triage process will question first,\nbecause the outcome is host uid=0 on a multi-tenant hosting panel. The temptation\nto publish Changed is genuine and we state it accurately rather than dismissing\nit: the vulnerable component is the panel application authorised to a tenant role,\nwhile the achieved impact lands on the host operating system and, in a\nmulti-tenant deployment, on every other tenant\u0027s site - components outside the\npanel\u0027s own authorisation boundary, impacted in their own right, by an action\nauthorised as \"a tenant edits a setting on their own site\". That is the textbook\nargument for Changed and it is not strained. We publish Unchanged for three\nreasons in increasing order of weight. First, the privilege ceiling is produced\nentirely by the vendor\u0027s own shipped configuration - `user root;` in the vendor\nnginx build, `user = root` in the vendor File Manager pool, and\n`clp ALL=(ALL) NOPASSWD: ALL` in the vendor sudoers drop-in - so every step of\nthe escalation is performed by a component the product itself installed,\nconfigured and invoked, and the product is the authority at each step. No second\nproduct\u0027s exposed interface is being reached through the first product\u0027s flaw;\nwhat is reached is the host, through identities the product established. Second,\nthe cross-tenant consequence is a capability inference and not a measurement: we\ndid not run the verification on a host with a second tenant installed and we\nmeasured no impact on another tenant, and publishing Scope Changed on an untested\ncross-tenant claim is precisely the class of overreach that produces public\ncorrections. Third, the conservative value already communicates the finding - 8.8\nHigh reads as remote authenticated host-root code execution to every triage\nprocess that consumes it, so nothing decision-relevant is lost by declining the\nupgrade. The Changed-scope form of the same facts,\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, is recorded in the analysis as a\nrejected reading: it is not published as a headline and no number is attached to\nit. If a triage process or an identifier-assigning authority prefers the Changed\nreading on the grounds that a tenant-scope authorisation boundary is crossed to\naffect the host and other tenants, the argument above is the complete case for it\nand the only missing evidence is a two-tenant measurement.\n\nAuthentication: post-authentication, lowest panel role. Sessions are ordinary\nSymfony sessions issued by a login POST carrying `userName`, `password` and\n`_csrf_token`. The site-settings page is not under `^/admin`, so it falls to the\ncatch-all rule requiring full authentication; the singular `role:` key in that\nrule is valid rather than a silent typo, because the framework\u0027s configuration\nnormalization folds it into the plural form, and the dynamic proof that the\ncatch-all is live is that an anonymous request for a deliberately nonexistent\npath returns 302 to the login page rather than 404, meaning the access-control\ncheck fires before route resolution. Fourteen sampled protected paths all\nredirected, and twelve URI-mismatch variants - trailing slash, doubled slash,\nencoded slash, matrix-semicolon path parameter, dot segments, percent-encoded\nletters, a null byte, upper-"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-250",
              "description": "CWE-250",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-269",
              "description": "CWE-269",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-74",
              "description": "CWE-74",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-78",
              "description": "CWE-78",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-93",
              "description": "CWE-93",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-02T07:30:02Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Oct/14"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Oct/14"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/cloudpanel-site-rootdirectory-nginx-vhost-injection-root-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Oct/14"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[0day-rubbish] CloudPanel 2.5.4-3 site-settings rootDirectory nginx virtual-host injection to host root code execution (8.8)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0485",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Oct/14",
            "automated": true,
            "contentSha256": "859614f1c0e095c70dea093ffd08d31799c64c0190543ef9abe06ba7faae9472",
            "evidenceScore": 11,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Oct/14",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-10-13T02:21:18Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-11-02T07:30:02Z",
    "dateUpdated": "2026-11-02T07:30:02Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0485"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.