Skip to content

Commit 9e1bc32

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-7p9h-m7m8-vhhv GHSA-j4rc-96xj-gvqc GHSA-mxc8-4jqf-368q GHSA-w7rq-fgx4-4xcm GHSA-wm8h-26fv-mg7g
1 parent 591b74b commit 9e1bc32

5 files changed

Lines changed: 307 additions & 13 deletions

File tree

‎advisories/github-reviewed/2026/01/GHSA-7p9h-m7m8-vhhv/GHSA-7p9h-m7m8-vhhv.json‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-7p9h-m7m8-vhhv",
4+
"modified": "2026-01-23T20:17:16Z",
5+
"published": "2026-01-23T20:17:16Z",
6+
"aliases": [],
7+
"summary": "phpMyFAQ: Attachment download allowed without dlattachment right (broken access control)",
8+
"details": "### Summary\nA logged‑in user without the dlattachment right can download FAQ attachments. This is due to a permissive permission check in attachment.php that treats the mere presence of a right key as authorization and a flawed group/user logic expression.\n\n### Details\nIn attachment.php, the access decision uses:\n```($groupPermission || ($groupPermission && $userPermission)) && isset($permission['dlattachment'])```\nisset() returns true even when the right value is false, and the logic simplifies to $groupPermission for some permission modes. As a result, a user without dlattachment can still access the attachment.\n\n### PoC\nPrecondition: A non‑admin user exists; an attachment is associated to a FAQ record; records.allowDownloadsForGuests = false.\nLog in as a non‑admin user without dlattachment.\nRequest the attachment download endpoint.\n```\ncurl -c /tmp/pmf_api_cookies.txt \\\n -H 'Content-Type: application/json' \\\n -d '{\"username\":\"tester\",\"password\":\"Test1234!\"}' \\\n http://192.168.40.16/phpmyfaq/api/v3.0/login\n\ncurl -i -b /tmp/pmf_api_cookies.txt \\\n \"http://192.168.40.16/phpmyfaq/index.php?action=attachment&id=1\"\n```\n\n### Impact\nUnauthorized users can download attachments (confidentiality breach). Depending on content, this may expose sensitive documents.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V3",
12+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "Packagist",
19+
"name": "phpmyfaq/phpmyfaq"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
},
28+
{
29+
"fixed": "4.0.17"
30+
}
31+
]
32+
}
33+
],
34+
"database_specific": {
35+
"last_known_affected_version_range": "<= 4.0.16"
36+
}
37+
},
38+
{
39+
"package": {
40+
"ecosystem": "Packagist",
41+
"name": "thorsten/phpmyfaq"
42+
},
43+
"ranges": [
44+
{
45+
"type": "ECOSYSTEM",
46+
"events": [
47+
{
48+
"introduced": "0"
49+
},
50+
{
51+
"fixed": "4.0.17"
52+
}
53+
]
54+
}
55+
],
56+
"database_specific": {
57+
"last_known_affected_version_range": "<= 4.0.16"
58+
}
59+
}
60+
],
61+
"references": [
62+
{
63+
"type": "WEB",
64+
"url": "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-7p9h-m7m8-vhhv"
65+
},
66+
{
67+
"type": "PACKAGE",
68+
"url": "https://github.com/thorsten/phpMyFAQ"
69+
}
70+
],
71+
"database_specific": {
72+
"cwe_ids": [
73+
"CWE-284"
74+
],
75+
"severity": "MODERATE",
76+
"github_reviewed": true,
77+
"github_reviewed_at": "2026-01-23T20:17:16Z",
78+
"nvd_published_at": null
79+
}
80+
}

‎advisories/github-reviewed/2026/01/GHSA-j4rc-96xj-gvqc/GHSA-j4rc-96xj-gvqc.json‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-j4rc-96xj-gvqc",
4+
"modified": "2026-01-23T20:17:33Z",
5+
"published": "2026-01-23T20:17:33Z",
6+
"aliases": [],
7+
"summary": "phpMyFAQ: Public API endpoints expose emails and invisible questions",
8+
"details": "### Summary\nSeveral public API endpoints return email addresses and non‑public records (e.g. open questions with isVisible=false).\n\n### Details\nOpenQuestionController::list() calls Question::getAll() with the default showAll=true, returning invisible questions and their emails. Similar exposures exist in comment/news/faq APIs.\n\n### PoC\n```\ncurl -i -H 'Accept-Language: en' \\\n http://192.168.40.16/phpmyfaq/api/v3.0/open-questions\n```\n\n### Impact\nPrivacy exposure of email addresses and non‑public content; increased risk of phishing/scraping.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V3",
12+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "Packagist",
19+
"name": "phpmyfaq/phpmyfaq"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
},
28+
{
29+
"fixed": "4.0.17"
30+
}
31+
]
32+
}
33+
],
34+
"database_specific": {
35+
"last_known_affected_version_range": "<= 4.0.16"
36+
}
37+
},
38+
{
39+
"package": {
40+
"ecosystem": "Packagist",
41+
"name": "thorsten/phpmyfaq"
42+
},
43+
"ranges": [
44+
{
45+
"type": "ECOSYSTEM",
46+
"events": [
47+
{
48+
"introduced": "0"
49+
},
50+
{
51+
"fixed": "4.0.17"
52+
}
53+
]
54+
}
55+
],
56+
"database_specific": {
57+
"last_known_affected_version_range": "<= 4.0.16"
58+
}
59+
}
60+
],
61+
"references": [
62+
{
63+
"type": "WEB",
64+
"url": "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-j4rc-96xj-gvqc"
65+
},
66+
{
67+
"type": "PACKAGE",
68+
"url": "https://github.com/thorsten/phpMyFAQ"
69+
}
70+
],
71+
"database_specific": {
72+
"cwe_ids": [
73+
"CWE-200"
74+
],
75+
"severity": "MODERATE",
76+
"github_reviewed": true,
77+
"github_reviewed_at": "2026-01-23T20:17:33Z",
78+
"nvd_published_at": null
79+
}
80+
}

advisories/unreviewed/2026/01/GHSA-mxc8-4jqf-368q/GHSA-mxc8-4jqf-368q.json renamed to advisories/github-reviewed/2026/01/GHSA-mxc8-4jqf-368q/GHSA-mxc8-4jqf-368q.json

Lines changed: 37 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,40 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-mxc8-4jqf-368q",
4-
"modified": "2026-01-23T18:31:28Z",
4+
"modified": "2026-01-23T20:16:21Z",
55
"published": "2026-01-23T18:31:28Z",
66
"aliases": [
77
"CVE-2025-67124"
88
],
9+
"summary": "miniserve affected by a TOCTOU and symlink race vulnerability",
910
"details": "A TOCTOU and symlink race in svenstaro/miniserve 0.32.0 upload finalization (when uploads are enabled) can allow an attacker to overwrite arbitrary files outside the intended upload/document root in deployments where the attacker can create/replace filesystem entries in the upload destination directory (e.g., shared writable directory/volume).",
10-
"severity": [],
11-
"affected": [],
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "crates.io",
21+
"name": "miniserve"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "0.32.0"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
1238
"references": [
1339
{
1440
"type": "ADVISORY",
@@ -19,15 +45,18 @@
1945
"url": "https://gist.github.com/thesmartshadow/55688f87f8b985eb530e07d00ef8c63f"
2046
},
2147
{
22-
"type": "WEB",
48+
"type": "PACKAGE",
2349
"url": "https://github.com/svenstaro/miniserve"
2450
}
2551
],
2652
"database_specific": {
27-
"cwe_ids": [],
28-
"severity": null,
29-
"github_reviewed": false,
30-
"github_reviewed_at": null,
53+
"cwe_ids": [
54+
"CWE-367",
55+
"CWE-59"
56+
],
57+
"severity": "MODERATE",
58+
"github_reviewed": true,
59+
"github_reviewed_at": "2026-01-23T20:16:21Z",
3160
"nvd_published_at": "2026-01-23T16:15:52Z"
3261
}
3362
}

advisories/unreviewed/2026/01/GHSA-w7rq-fgx4-4xcm/GHSA-w7rq-fgx4-4xcm.json renamed to advisories/github-reviewed/2026/01/GHSA-w7rq-fgx4-4xcm/GHSA-w7rq-fgx4-4xcm.json

Lines changed: 30 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,40 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-w7rq-fgx4-4xcm",
4-
"modified": "2026-01-23T18:31:30Z",
4+
"modified": "2026-01-23T20:16:37Z",
55
"published": "2026-01-23T18:31:30Z",
66
"aliases": [
77
"CVE-2025-71177"
88
],
9+
"summary": "LavaLite CMS affected by a stored cross-site scripting vulnerability",
910
"details": "LavaLite CMS versions up to and including 10.1.0 contain a stored cross-site scripting vulnerability in the package creation and search functionality. Authenticated users can supply crafted HTML or JavaScript in the package Name or Description fields that is stored and later rendered without proper output encoding in package search results. When other users view search results that include the malicious package, the injected script executes in their browsers, potentially enabling session hijacking, credential theft, and unauthorized actions in the context of the victim.",
1011
"severity": [
1112
{
1213
"type": "CVSS_V4",
13-
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Packagist",
21+
"name": "lavalite/cms"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"last_affected": "10.1.0"
32+
}
33+
]
34+
}
35+
]
1436
}
1537
],
16-
"affected": [],
1738
"references": [
1839
{
1940
"type": "ADVISORY",
@@ -23,6 +44,10 @@
2344
"type": "WEB",
2445
"url": "https://github.com/LavaLite/cms/issues/420"
2546
},
47+
{
48+
"type": "PACKAGE",
49+
"url": "https://github.com/LavaLite/cms"
50+
},
2651
{
2752
"type": "WEB",
2853
"url": "https://lavalite.org"
@@ -37,8 +62,8 @@
3762
"CWE-79"
3863
],
3964
"severity": "MODERATE",
40-
"github_reviewed": false,
41-
"github_reviewed_at": null,
65+
"github_reviewed": true,
66+
"github_reviewed_at": "2026-01-23T20:16:37Z",
4267
"nvd_published_at": "2026-01-23T17:16:08Z"
4368
}
4469
}

‎advisories/github-reviewed/2026/01/GHSA-wm8h-26fv-mg7g/GHSA-wm8h-26fv-mg7g.json‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-wm8h-26fv-mg7g",
4+
"modified": "2026-01-23T20:17:25Z",
5+
"published": "2026-01-23T20:17:25Z",
6+
"aliases": [],
7+
"summary": "phpMyFAQ: /api/setup/backup accessible to any authenticated user (authz missing)",
8+
"details": "### Summary\nAuthenticated non‑admin users can call /api/setup/backup and trigger a configuration backup. The endpoint only checks authentication, not authorization, and returns a link to the generated ZIP.\n\n### Details\nSetupController.php uses userIsAuthenticated() but does not verify that the requester has configuration/admin permissions. This allows any logged‑in user to create a sensitive backup and retrieve its path.\n\n### PoC\nPrecondition: API enabled, any authenticated non‑admin user.\n- Log in as a non‑admin user.\n- Call backup endpoint.\n```\ncurl -c /tmp/pmf_api_cookies.txt \\\n -H 'Content-Type: application/json' \\\n -d '{\"username\":\"tester\",\"password\":\"Test1234!\"}' \\\n http://192.168.40.16/phpmyfaq/api/v3.0/login\n\ncurl -i -b /tmp/pmf_api_cookies.txt \\\n -X POST --data '4.0.16' \\\n http://192.168.40.16/phpmyfaq/api/setup/backup\n```\n\n### Impact\nLow‑privileged users can generate sensitive backups. If the ZIP is web‑accessible (server misconfiguration), this can lead to secret exposure.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V3",
12+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "Packagist",
19+
"name": "phpmyfaq/phpmyfaq"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
},
28+
{
29+
"fixed": "4.0.17"
30+
}
31+
]
32+
}
33+
],
34+
"database_specific": {
35+
"last_known_affected_version_range": "<= 4.0.16"
36+
}
37+
},
38+
{
39+
"package": {
40+
"ecosystem": "Packagist",
41+
"name": "thorsten/phpmyfaq"
42+
},
43+
"ranges": [
44+
{
45+
"type": "ECOSYSTEM",
46+
"events": [
47+
{
48+
"introduced": "0"
49+
},
50+
{
51+
"fixed": "4.0.17"
52+
}
53+
]
54+
}
55+
],
56+
"database_specific": {
57+
"last_known_affected_version_range": "<= 4.0.16"
58+
}
59+
}
60+
],
61+
"references": [
62+
{
63+
"type": "WEB",
64+
"url": "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-wm8h-26fv-mg7g"
65+
},
66+
{
67+
"type": "PACKAGE",
68+
"url": "https://github.com/thorsten/phpMyFAQ"
69+
}
70+
],
71+
"database_specific": {
72+
"cwe_ids": [
73+
"CWE-285"
74+
],
75+
"severity": "MODERATE",
76+
"github_reviewed": true,
77+
"github_reviewed_at": "2026-01-23T20:17:25Z",
78+
"nvd_published_at": null
79+
}
80+
}

0 commit comments

Comments
 (0)