Skip to content

Commit 6373696

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-mxxc-p822-2hx9 GHSA-wp53-j4wj-2cfg
1 parent 9c10339 commit 6373696

2 files changed

Lines changed: 135 additions & 0 deletions

File tree

‎advisories/github-reviewed/2026/01/GHSA-mxxc-p822-2hx9/GHSA-mxxc-p822-2hx9.json‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-mxxc-p822-2hx9",
4+
"modified": "2026-01-26T23:26:56Z",
5+
"published": "2026-01-26T23:26:56Z",
6+
"aliases": [
7+
"CVE-2026-24470"
8+
],
9+
"summary": "Skipper Ingress Controller Allows Unauthorized Access to Internal Services via ExternalName",
10+
"details": "### Impact\n\nWhen running Skipper as an Ingress controller, users with permissions to create an Ingress and a Service of type ExternalName can create routes that enable them to use Skipper's network access to reach internal services.\n\n### Patches\n\nhttps://github.com/zalando/skipper/releases/tag/v0.24.0 disables Kubernetes ExternalName by default.\n\n### Workarounds\n\nDevelopers can allow list targets of an ExternalName by using `-kubernetes-only-allowed-external-names=true` and allow list via regular expressions `-kubernetes-allowed-external-name '^[a-z][a-z0-9-.]+[.].allowed.example$'` \n\n### References\n\nhttps://kubernetes.io/docs/concepts/services-networking/service/#externalname",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "github.com/zalando/skipper"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "0.24.0"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/zalando/skipper/security/advisories/GHSA-mxxc-p822-2hx9"
42+
},
43+
{
44+
"type": "WEB",
45+
"url": "https://github.com/zalando/skipper/commit/a4c87ce029a58eb8e1c2c1f93049194a39cf6219"
46+
},
47+
{
48+
"type": "PACKAGE",
49+
"url": "https://github.com/zalando/skipper"
50+
},
51+
{
52+
"type": "WEB",
53+
"url": "https://github.com/zalando/skipper/releases/tag/v0.24.0"
54+
},
55+
{
56+
"type": "WEB",
57+
"url": "https://kubernetes.io/docs/concepts/services-networking/service/#externalname"
58+
}
59+
],
60+
"database_specific": {
61+
"cwe_ids": [
62+
"CWE-441",
63+
"CWE-918"
64+
],
65+
"severity": "HIGH",
66+
"github_reviewed": true,
67+
"github_reviewed_at": "2026-01-26T23:26:56Z",
68+
"nvd_published_at": null
69+
}
70+
}

‎advisories/github-reviewed/2026/01/GHSA-wp53-j4wj-2cfg/GHSA-wp53-j4wj-2cfg.json‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-wp53-j4wj-2cfg",
4+
"modified": "2026-01-26T23:28:05Z",
5+
"published": "2026-01-26T23:28:05Z",
6+
"aliases": [
7+
"CVE-2026-24486"
8+
],
9+
"summary": "Python-Multipart has Arbitrary File Write via Non-Default Configuration",
10+
"details": "### Summary\n\nA Path Traversal vulnerability exists when using non-default configuration options `UPLOAD_DIR` and `UPLOAD_KEEP_FILENAME=True`. An attacker can write uploaded files to arbitrary locations on the filesystem by crafting a malicious filename.\n\n### Details\n\nWhen `UPLOAD_DIR` is set and `UPLOAD_KEEP_FILENAME` is `True`, the library constructs the file path using `os.path.join(file_dir, fname)`. Due to the behavior of `os.path.join()`, if the filename begins with a `/`, all preceding path components are discarded:\n\n```py\nos.path.join(\"/upload/dir\", \"/etc/malicious\") == \"/etc/malicious\"\n```\n \nThis allows an attacker to bypass the intended upload directory and write files to arbitrary paths. \n \n#### Affected Configuration \n \nProjects are only affected if all of the following are true: \n- `UPLOAD_DIR` is set\n- `UPLOAD_KEEP_FILENAME` is set to True\n- The uploaded file exceeds `MAX_MEMORY_FILE_SIZE` (triggering a flush to disk)\n\nThe default configuration is not vulnerable. \n \n#### Impact \n \nArbitrary file write to attacker-controlled paths on the filesystem. \n \n#### Mitigation \n \nUpgrade to version 0.0.22, or avoid using `UPLOAD_KEEP_FILENAME=True` in project configurations.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "PyPI",
21+
"name": "python-multipart"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "0.0.22"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/Kludex/python-multipart/security/advisories/GHSA-wp53-j4wj-2cfg"
42+
},
43+
{
44+
"type": "WEB",
45+
"url": "https://github.com/Kludex/python-multipart/commit/9433f4bbc9652bdde82bbe380984e32f8cfc89c4"
46+
},
47+
{
48+
"type": "PACKAGE",
49+
"url": "https://github.com/Kludex/python-multipart"
50+
},
51+
{
52+
"type": "WEB",
53+
"url": "https://github.com/Kludex/python-multipart/releases/tag/0.0.22"
54+
}
55+
],
56+
"database_specific": {
57+
"cwe_ids": [
58+
"CWE-22"
59+
],
60+
"severity": "HIGH",
61+
"github_reviewed": true,
62+
"github_reviewed_at": "2026-01-26T23:28:05Z",
63+
"nvd_published_at": null
64+
}
65+
}

0 commit comments

Comments
 (0)