DEV Community: CVE Reports

CVE-2026-53951: CVE-2026-53951: Trust-Prefix Bypass via Path Traversal leading to Remote Code Execution in Copier

CVE Reports — Thu, 20 Aug 2026 09:32:30 +0000

CVE-2026-53951: Trust-Prefix Bypass via Path Traversal leading to Remote Code Execution in Copier

Vulnerability ID: CVE-2026-53951
CVSS Score: 8.8
Published: 2026-08-19

A security vulnerability in Copier versions 9.5.0 through 9.15.1 allows unauthenticated remote code execution via crafted HTTP requests or local paths containing traversal sequences. The trust-evaluation mechanism compares target repository paths or URLs against trusted prefixes using unnormalized string comparison, while the subsequent fetching mechanism normalizes the path before cloning. Attackers can exploit this asymmetry to bypass security warning prompts and execute arbitrary commands under the local user context.

TL;DR

Copier's template trust validation fails to normalize repository paths prior to evaluating prefix trust lists, permitting attackers to bypass safety verification prompts and execute arbitrary lifecycle tasks through path traversal payloads.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-22, CWE-94
Attack Vector: Local / Remote Fetching
CVSS Base Score: 8.8 (High)
Exploit Status: poc
KEV Status: Not Listed
Affected Versions: >= 9.5.0, <= 9.15.1

Affected Systems

Copier Library and CLI Application
Copier: >= 9.5.0, <= 9.15.1 (Fixed in: 9.15.2)

Mitigation Strategies

Upgrade Copier to version 9.15.2 or above.
Clear or comment out configured trusted_prefixes in configuration files to force prompt checks on all templates.
Run template updates only with explicit user confirmation in non-automated environments.

Remediation Steps:

Update the Copier CLI tool using pip: pip install --upgrade copier.
Verify the installed version: copier --version.
Audit active configurations in ~/.config/copier/settings.yaml and verify that trusted_prefixes does not contain overly permissive paths or domains.

References

Read the full report for CVE-2026-53951 on our website for more details including interactive diagrams and full exploit analysis.

GHSA-P77J-G7H5-R2VW: GHSA-P77J-G7H5-R2VW: Tier-0 Security Hardening in GeoLens

CVE Reports — Thu, 20 Aug 2026 08:31:01 +0000

GHSA-P77J-G7H5-R2VW: Tier-0 Security Hardening in GeoLens

Vulnerability ID: GHSA-P77J-G7H5-R2VW
CVSS Score: 8.8
Published: 2026-08-19

GeoLens before version 1.2.4 contains multiple critical-tier security vulnerabilities including improper authorization in metadata access, tile cache scope leakage, dataset title enumeration, weak default credentials, and denial of service via STAC POST search.

TL;DR

Multiple vulnerabilities in GeoLens allow unauthorized metadata and map tile disclosure, unauthenticated Denial of Service, and administrative takeover via weak default credentials.

Technical Details

CWE ID: CWE-285
Attack Vector: Network
CVSS v3.1 Score: 8.8
EPSS Score: 0.001
Impact: Data Disclosure / System Compromise
Exploit Status: none
CISA KEV Status: Not Listed

Affected Systems

GeoLens Catalog System
GeoLens Installer Tool
GeoLens STAC API Module

Mitigation Strategies

Upgrading GeoLens to version 1.2.4 or higher
Configuring reverse proxies to bypass cache for non-public coordinate requests
Applying web application firewall (WAF) size limits on STAC search POST endpoints

Remediation Steps:

Verify environment variables and check out tag v1.2.4
Run the automated installer script ./scripts/install.sh to update backend files and apply database migrations
Rotate default database and administrator passwords in the .env configuration file
Restart Nginx and restart backend application containers to reload the updated security configuration

References

Read the full report for GHSA-P77J-G7H5-R2VW on our website for more details including interactive diagrams and full exploit analysis.

CVE-2026-55694: CVE-2026-55694: Chained Information Disclosure and IDOR in Snipe-IT EULA Management

CVE Reports — Thu, 20 Aug 2026 07:30:30 +0000

CVE-2026-55694: Chained Information Disclosure and IDOR in Snipe-IT EULA Management

Vulnerability ID: CVE-2026-55694
CVSS Score: 7.1
Published: 2026-08-19

CVE-2026-55694 is a chained Information Disclosure and Insecure Direct Object Reference (IDOR) vulnerability in Snipe-IT prior to version 8.6.3. The vulnerability allows authenticated, restricted users to completely bypass randomized file-naming security controls, leak the obfuscated filenames of signed End User License Agreements (EULAs), and subsequently download these confidential documents across tenant boundaries.

TL;DR

Chained IDOR and information disclosure in Snipe-IT allows authenticated, low-privileged users to bypass file name randomization and download signed EULAs of any user.

Technical Details

CWE ID: CWE-639
Attack Vector: Network (AV:N)
CVSS v4.0 Score: 7.1 (High)
Exploit Status: None
KEV Status: Not Listed
Ransomware Association: No
Vulnerability Class: Information Disclosure & IDOR Chain

Affected Systems

Snipe-IT Asset Management System
Snipe-IT: < 8.6.3 (Fixed in: 8.6.3)

Code Analysis

Commit: f15d786

Fix: IDOR vulnerability in EULA download via ProfileController and UsersController API

@@ -893,7 +893,7 @@ public function getCurrentUserInfo(Request $request): array
      */
     public function eulas(User $user, ActionlogsTransformer $transformer)
     {
-        $this->authorize('view', User::class);
+        $this->authorize('view', $user);

Mitigation Strategies

Upgrade Snipe-IT to version 8.6.3 or higher.
Block traffic to vulnerable EULA API and profile download routes at the reverse proxy or web server layer.
Perform audit log analysis to detect sequential requests targeting user EULA endpoints.

Remediation Steps:

Navigate to the Snipe-IT installation directory.
Pull the latest updates and switch to the patched release branch using 'git checkout v8.6.3'.
Run 'composer install --no-dev --prefer-dist' to update dependencies.
Run 'php artisan migrate' to ensure database structures are up to date.
Clear the application cache using 'php artisan config:clear' and 'php artisan cache:clear'.

References

Read the full report for CVE-2026-55694 on our website for more details including interactive diagrams and full exploit analysis.

CVE-2026-55703: CVE-2026-55703: Missing Authorization in Snipe-IT Maintenance Records

CVE Reports — Thu, 20 Aug 2026 06:30:28 +0000

CVE-2026-55703: Missing Authorization in Snipe-IT Maintenance Records

Vulnerability ID: CVE-2026-55703
CVSS Score: 4.3
Published: 2026-08-19

Snipe-IT is an IT asset/license management system. Prior to 8.6.3, any activated account can request /maintenances/{id} and read maintenance records for assets in the same company without asset or maintenance permission. app/Http/Controllers/MaintenancesController.php show() renders the record without authorize(), while company-scoped route-model binding only prevents access to other companies. Disclosed fields include asset tags, suppliers, purchase costs, notes, and dates. This issue is fixed in version 8.6.3.

TL;DR

An insecure direct object reference (IDOR) flaw in Snipe-IT allows any authenticated user to view asset maintenance logs and financial/vendor data without permission.

Technical Details

CWE ID: CWE-862
Attack Vector: Network (AV:N)
CVSS v3.1 Score: 4.3 (Medium)
Impact: Partial Confidentiality Loss
Exploit Status: No public PoC
KEV Status: Not Listed

Affected Systems

Snipe-IT

Mitigation Strategies

Upgrade Snipe-IT to version 8.6.3 or higher
Implement network access controls to isolate the asset management console
Monitor web logs for sequential ID scanning of /maintenances/

Remediation Steps:

Verify current Snipe-IT version through the admin dashboard
Apply security update using standard composer commands or docker image update
Perform a verification check attempting to view asset maintenance with a test non-admin user account

References

Read the full report for CVE-2026-55703 on our website for more details including interactive diagrams and full exploit analysis.

CVE-2026-61807: CVE-2026-61807: Stored DOM-Based Cross-Site Scripting in Snipe-IT

CVE Reports — Thu, 20 Aug 2026 05:30:28 +0000

CVE-2026-61807: Stored DOM-Based Cross-Site Scripting in Snipe-IT

Vulnerability ID: CVE-2026-61807
CVSS Score: 6.3
Published: 2026-08-19

A Stored DOM-based Cross-Site Scripting (DOM XSS) vulnerability exists in Snipe-IT versions prior to 8.6.2. The vulnerability occurs when a stored manufacturer or supplier name is converted to CamelCase and rendered within the 'data-selected-count-id' attribute of a table. Client-side JavaScript retrieves this decoded attribute and performs unsafe string concatenation, passing it directly into jQuery's '.after()' method, enabling authenticated attackers to execute arbitrary JavaScript in the victim's session.

TL;DR

Authenticated low-privilege users can execute arbitrary JavaScript in the browsers of administrators by creating or renaming a manufacturer or supplier with a crafted malicious payload, exploiting unsafe client-side DOM construction via jQuery.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-79
Attack Vector: Network (AV:N)
CVSS v4.0 Score: 6.3
Exploit Status: Proof of Concept / Theoretical
CISA KEV Status: Not Listed
Impact: Stored DOM-Based Cross-Site Scripting (DOM XSS)

Affected Systems

Snipe-IT
Snipe-IT: < 8.6.2 (Fixed in: 8.6.2)

Code Analysis

Commit: d12ad3d

Fix commit addressing unsafe DOM element construction in bootstrap-table.blade.php

Vulnerable code concatenation in bootstrap-table.blade.php is replaced with safe programmatic jQuery element builders and document.createTextNode.

Mitigation Strategies

Upgrade to Snipe-IT version 8.6.2 or higher.
Enable native Content Security Policy (CSP) headers in the .env file.
Restrict write access on manufacturer and supplier configuration views to trusted users.

Remediation Steps:

Verify current Snipe-IT version.
Backup application files and the SQL database.
Execute composer update or pull the latest docker image for version 8.6.2.
Ensure .env contains ENABLE_CSP=true.
Validate that the manufacturer detail pages load correctly without errors.

References

Read the full report for CVE-2026-61807 on our website for more details including interactive diagrams and full exploit analysis.

CVE-2026-62673: CVE-2026-62673: Security Bypass in Grav CMS via Case-Sensitivity Mismatch

CVE Reports — Thu, 20 Aug 2026 04:31:31 +0000

CVE-2026-62673: Security Bypass in Grav CMS via Case-Sensitivity Mismatch

Vulnerability ID: CVE-2026-62673
CVSS Score: 8.2
Published: 2026-08-19

CVE-2026-62673 (also known as CVE-2026-62230 and GHSA-vwg3-w8w3-pc79) is a high-severity security bypass vulnerability in the Grav CMS. It permits unauthenticated remote attackers to circumvent directory and file access policies defined in Apache .htaccess. This flaw allows direct retrieval of sensitive configuration files, system-level credentials, and database equivalents from case-insensitive host filesystems.

TL;DR

Unauthenticated remote security bypass in Grav CMS on case-insensitive filesystems allows attackers to access sensitive configuration files and credentials by altering request letter casing.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-178 (Improper Handling of Case Sensitivity)
Attack Vector: Network (N)
CVSS v4.0: 8.2 (High)
Exploit Status: PoC (Proof of Concept Available)
Impact: Security Bypass / Sensitive File Disclosure
KEV Status: Not Listed

Affected Systems

Grav CMS installations on Windows (NTFS), macOS (APFS), or case-insensitive Docker environments running Apache.
grav: < 2.0.4 (Fixed in: 2.0.4)

Code Analysis

Commit: 8c9d1e7

security: make .htaccess security rules case-insensitive (GHSA-vwg3-w8w3-pc79)

@@ -2,11 +2,11 @@
 ## Begin - Security
 # Block all direct access for these folders
-RewriteRule ^(\.git|cache|bin|logs|backup|webserver-configs|tests)/(.*) error [F]
+RewriteRule ^(\.git|cache|bin|logs|backup|webserver-configs|tests)/(.*) error [F,NC]

Exploit Details

GitHub Advisory: Vulnerability disclosure detailing security bypass on case-insensitive filesystems.

Mitigation Strategies

Upgrade Grav to version 2.0.4 or higher.
Apply the NC (No Case) flag to all rewrite rules within the .htaccess and webserver-configs/htaccess.txt files.
Host Grav on a case-sensitive file system.

Remediation Steps:

Verify the current Grav version using the administrative dashboard or CLI.
Update the system to version 2.0.4 using the built-in package manager or manual deployment.
If manual updates are required, modify the root .htaccess file to include the [F,NC] flags on rewrite rules blocking access to user/ and system/ directories.

References

Read the full report for CVE-2026-62673 on our website for more details including interactive diagrams and full exploit analysis.

GHSA-HJWH-XVFW-QRWJ: GHSA-HJWH-XVFW-QRWJ: Credential Disclosure via Diagnostic Boundaries in mcp-searxng

CVE Reports — Thu, 20 Aug 2026 03:30:30 +0000

GHSA-HJWH-XVFW-QRWJ: Credential Disclosure via Diagnostic Boundaries in mcp-searxng

Vulnerability ID: GHSA-HJWH-XVFW-QRWJ
CVSS Score: 5.5
Published: 2026-08-19

A credential disclosure vulnerability in the mcp-searxng NPM package prior to version 1.12.0 allows attackers to recover plain-text SearXNG Basic Authentication credentials. The application exposes these credentials via console logs (stderr), MCP logging notifications, validation error messages, and JSON-RPC error responses. This occurs because the application lacks comprehensive sanitization across diagnostic boundaries when credentials are parsed from the SEARXNG_URL environment variable.

TL;DR

mcp-searxng before 1.12.0 leaks plain-text SearXNG Basic Authentication credentials via standard error logs, MCP notifications, and JSON-RPC error outputs. Upgrading to 1.12.0 remediates the issue via a robust diagnostic sanitization layer.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-209, CWE-532
Attack Vector: Local (AV:L) / Logical exposure via MCP clients
CVSS Score: 5.5 (Medium)
Exploit Status: Proof of Concept (PoC) documented
Affected Versions: < 1.12.0
Patched Version: 1.12.0
KEV Status: Not Listed

Affected Systems

mcp-searxng NPM package
mcp-searxng: < 1.12.0 (Fixed in: 1.12.0)

Mitigation Strategies

Upgrade mcp-searxng to version 1.12.0 or newer to enable centralized diagnostic sanitization.
Rotate any exposed credentials stored in the SEARXNG_URL environment variable.
Configure parameter properties in server.json to mark authentication parameters as secret.

Remediation Steps:

Update the package dependency via 'npm install mcp-searxng@latest'.
Modify the SearXNG instance configuration to invalidate previously exposed Basic Auth keys.
Purge system error logs and centralized log aggregator data containing unredacted credentials.

References

Read the full report for GHSA-HJWH-XVFW-QRWJ on our website for more details including interactive diagrams and full exploit analysis.

CVE-2026-61711: CVE-2026-61711: Sandbox Escape via Protobuf SecurityMode Enum Validation Bypass in Moby BuildKit

CVE Reports — Thu, 20 Aug 2026 01:31:24 +0000

CVE-2026-61711: Sandbox Escape via Protobuf SecurityMode Enum Validation Bypass in Moby BuildKit

Vulnerability ID: CVE-2026-61711
CVSS Score: 5.3
Published: 2026-08-19

A detailed technical analysis of CVE-2026-61711, an input validation flaw in Moby BuildKit prior to version 0.31.1. The flaw allows unauthorized or custom frontends to construct build execution environments where Seccomp and AppArmor configurations are completely disabled by supplying an invalid protobuf enum index, resulting in an elevated kernel-level attack surface inside the build sandbox.

TL;DR

Moby BuildKit before v0.31.1 fails to validate protobuf SecurityMode enums, allowing invalid values to disable Seccomp and AppArmor security profiles on execution containers.

Technical Details

CWE ID: CWE-20
Attack Vector: Network (AV:N)
CVSS Score: 5.3
EPSS Score: N/A
Impact: Low (Confidentiality, Integrity, Availability)
Exploit Status: None
KEV Status: Not Listed

Affected Systems

Moby BuildKit
BuildKit: < 0.31.1 (Fixed in: 0.31.1)

Code Analysis

Commit: 3ea6dd0

Validate security mode configuration when compiling OCI specifications

Commit: 64bbec8

Apply cherry-picked validation engine changes and integration tests

Mitigation Strategies

Implement strict network segmentation to block access to BuildKit's TCP endpoint.
Restrict build permissions to verified users on shared container hosts.
Verify runtime logging for container execution flags in untrusted builds.

Remediation Steps:

Identify running instances of Moby BuildKit and determine their current version.
Retrieve and compile the updated v0.31.1 release package or install updated distributions.
Reboot the BuildKit daemon to execute the patched binaries.
Run test suites to confirm that builds utilizing invalid enums are actively rejected with the invalid security mode message.

References

Read the full report for CVE-2026-61711 on our website for more details including interactive diagrams and full exploit analysis.

CVE-2026-61712: CVE-2026-61712: Denial of Service via Unbounded Resource Allocation in moby/buildkit

CVE Reports — Thu, 20 Aug 2026 00:31:20 +0000

CVE-2026-61712: Denial of Service via Unbounded Resource Allocation in moby/buildkit

Vulnerability ID: CVE-2026-61712
CVSS Score: 2.3
Published: 2026-08-19

moby/buildkit is susceptible to a denial-of-service vulnerability prior to version 0.31.1. When BuildKit processes user or group directives from untrusted build contexts or base images, it reads configuration databases such as /etc/passwd and /etc/group directly into memory without enforcing boundaries. An attacker can exploit this behavior by engineering malicious files that trigger host memory exhaustion or block daemon threads indefinitely.

TL;DR

moby/buildkit prior to version 0.31.1 does not enforce size limits or validate file types when reading user and group databases inside build contexts, enabling attackers to crash the buildkitd daemon via memory exhaustion (OOM) or hang execution threads.

Technical Details

CWE ID: CWE-770
Attack Vector: Network
CVSS v4.0: 2.3 (Low)
Impact: Denial of Service (DoS)
Exploit Status: none
CISA KEV Status: No

Affected Systems

moby/buildkit
buildkit: < 0.31.1 (Fixed in: 0.31.1)

Code Analysis

Commit: 408266e

Fix unbounded reading of user files in OCI executor

--- a/executor/oci/user.go\n+++ b/executor/oci/user.go\n@@ -11,4 +11,27 @@\n+const maxUserFileBytes = 10 << 20\n+func openUserFile(root, p string) (io.ReadCloser, error) {\n+...\n+info, err := f.Stat()\n+...\n+if !info.Mode().IsRegular() {\n+...\n+return &limitedReadCloser{ReadCloser: f, r: &io.LimitedReader{R: f, N: maxUserFileBytes + 1}, name: p}, nil

Commit: 69a3924

Limit size of user and group files in LLB solver ops

--- a/solver/llbsolver/ops/user_linux.go\n+++ b/solver/llbsolver/ops/user_linux.go\n@@ -21,1 +21,1 @@\n-ufile, err := os.Open(passwdPath)\n+ufile, err := openUserFile(dir, passwdPath)

Mitigation Strategies

Upgrade moby/buildkit to version 0.31.1 or higher.
Configure cgroup-level memory limits on build nodes to prevent host system crashes.
Run the buildkitd daemon in rootless mode to restrict container escape vectors.

Remediation Steps:

Identify the current BuildKit version using the command 'buildkitd --version'.
If the version is less than 0.31.1, download the updated binary package from the official repository.
Update systemd services or Kubernetes runner definitions to deploy BuildKit 0.31.1.
Restart the buildkitd daemon using 'systemctl restart buildkit'.

References

Read the full report for CVE-2026-61712 on our website for more details including interactive diagrams and full exploit analysis.

CVE-2026-59992: CVE-2026-59992: Broken Access Control and Path Traversal in Tina CMS Production Media Adapters

CVE Reports — Wed, 19 Aug 2026 23:30:29 +0000

CVE-2026-59992: Broken Access Control and Path Traversal in Tina CMS Production Media Adapters

Vulnerability ID: CVE-2026-59992
CVSS Score: 5.4
Published: 2026-08-19

CVE-2026-59992 is a critical broken access control vulnerability in the first-party production media adapters of Tina CMS, including next-tinacms-s3, next-tinacms-dos, next-tinacms-azure, and next-tinacms-cloudinary. The issue allows authenticated editors to escape the configured mediaRoot directory containment, facilitating unauthorized file uploads, modifications, and deletions across the entire storage bucket or container.

TL;DR

A broken access control flaw in Tina CMS media adapters allows authenticated editors to bypass directory containment and write or delete files globally across the connected cloud storage container using path traversal.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-639 / CWE-862
Attack Vector: Network (AV:N)
CVSS Score: 5.4 (Medium)
Exploit Status: poc
KEV Status: Not Listed
Impact: Unauthorized Write/Delete (Integrity & Availability)

Affected Systems

Tina CMS
next-tinacms-s3
next-tinacms-dos
next-tinacms-azure
next-tinacms-cloudinary
next-tinacms-s3: < 23.0.4 (Fixed in: 23.0.4)
next-tinacms-dos: < 23.0.4 (Fixed in: 23.0.4)
next-tinacms-azure: < 14.0.4 (Fixed in: 14.0.4)
next-tinacms-cloudinary: < 26.0.4 (Fixed in: 26.0.4)

Code Analysis

Commit: d44558e

Fix broken access control in media handlers by implementing media-key.ts resolver

@@ -66,15 +67,28 @@ export const createMediaHandler = (config: S3Config, options?: S3Options) => {
     switch (req.method) {
       case 'GET':
         if (req.query.key) {
-          const expiresIn: number =
-            (req.query.expiresIn && Number(req.query.expiresIn)) || 3600;
-          const s3_key = req.query.key
-            ? Array.isArray(req.query.key)
-              ? req.query.key[0]
-              : req.query.key
-            : null;
-          if (!s3_key) {
-            return res.status(400).json({ message: 'key is required' });
+          const requestedExpiresIn = Number(req.query.expiresIn);
+          const expiresIn =
+            Number.isFinite(requestedExpiresIn) && requestedExpiresIn > 0
+              ? Math.min(requestedExpiresIn, 3600)
+              : 3600;
+          const rawKey = Array.isArray(req.query.key)
+            ? req.query.key[0]
+            : req.query.key;
+          let s3_key: string;
+          try {
+            s3_key = resolveKey(mediaRoot, rawKey, { decode: false });
+          } catch (e) {
+            if (e instanceof MediaKeyError) {
+              return res.status(400).json({ message: e.message });
+            }
+            throw e;
+          }

Exploit Details

GitHub Security Advisory: Exploit concepts and root cause outlined in the official advisory.

Mitigation Strategies

Upgrade all affected Tina CMS adapter packages to the patched versions immediately.
Restrict IAM and bucket policy permissions for the CMS credentials to the specific mediaRoot directory at the cloud provider level.
Implement Web Application Firewall (WAF) rules to block path traversal payloads in request queries targeting media handler endpoints.

Remediation Steps:

Identify which media adapters are used in your Tina CMS project (e.g., next-tinacms-s3, next-tinacms-azure).
Update your package.json dependencies to specify patched versions: next-tinacms-s3 >= 23.0.4, next-tinacms-dos >= 23.0.4, next-tinacms-azure >= 14.0.4, next-tinacms-cloudinary >= 26.0.4.
Run your package manager install command (e.g., npm install or yarn install) to pull the updated versions.
Review cloud storage IAM permissions and modify policies to limit write and delete access specifically to the designated folder prefix.

References

Read the full report for CVE-2026-59992 on our website for more details including interactive diagrams and full exploit analysis.

CVE-2026-63123: CVE-2026-63123: Cross-Site Request Forgery leading to Cross-Origin Arbitrary File Write in @tinacms/cli

CVE Reports — Wed, 19 Aug 2026 22:30:30 +0000

CVE-2026-63123: Cross-Site Request Forgery leading to Cross-Origin Arbitrary File Write in @tinacms/cli

Vulnerability ID: CVE-2026-63123
CVSS Score: 6.5
Published: 2026-08-19

A Cross-Site Request Forgery (CSRF) vulnerability in the local development server of @tinacms/cli allowed malicious cross-origin pages to send state-changing HTTP requests. This issue permitted attackers to write arbitrary files into a developer's project directory or manipulate search and GraphQL indices without authorization.

TL;DR

A validation failure in the local TinaCMS dev server allowed external websites to perform arbitrary file writes inside the developer's project folder via cross-origin multipart form uploads.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-352 (Cross-Site Request Forgery)
Attack Vector: Network (Unauthenticated, requiring User Interaction)
CVSS Base Score: 6.5
Impact: High Integrity Impact (Arbitrary File Write)
Exploit Status: Proof-of-Concept
CISA KEV Status: Not Listed

Affected Systems

@tinacms/cli local development environments running prior to version 2.5.2
@tinacms/cli: < 2.5.2 (Fixed in: 2.5.2)

Code Analysis

Commit: 211997c

Reject cross-origin state-changing requests on the dev server with server-side validation

Exploit Details

GitHub Security Advisory: Advisory text outlining the conceptual bypass mechanism and how developers are affected.

Mitigation Strategies

Update @tinacms/cli to 2.5.2 or later to enable server-side origin gating
Configure dev servers to bind only to local loopback interfaces (127.0.0.1 / [::1])
Ensure web browsers used for testing local interfaces do not navigate untrusted websites simultaneously

Remediation Steps:

Navigate to the project root directory.
Execute package upgrade: npm install @tinacms/cli@latest --save-dev or yarn upgrade @tinacms/cli@latest.
Verify the installed version is 2.5.2 or higher using npx tinacms --version.

References

Read the full report for CVE-2026-63123 on our website for more details including interactive diagrams and full exploit analysis.

CVE-2026-63188: CVE-2026-63188: Unauthenticated Directory Traversal in @logto/tunnel

CVE Reports — Wed, 19 Aug 2026 21:30:31 +0000

CVE-2026-63188: Unauthenticated Directory Traversal in @logto/tunnel

Vulnerability ID: CVE-2026-63188
CVSS Score: 8.7
Published: 2026-08-19

A high-severity path traversal vulnerability exists in the @logto/tunnel npm package (part of the Logto repository) prior to version 0.3.9. Remote unauthenticated attackers can exploit this vulnerability to read arbitrary local files by sending crafted HTTP requests with directory traversal sequences when the static file proxy is active.

TL;DR

Unauthenticated remote directory traversal in @logto/tunnel < 0.3.9 allows arbitrary file read via crafted GET requests when custom experience hosting is enabled.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-22
Attack Vector: Network (AV:N)
CVSS Score: 8.7 (High)
Exploit Status: Proof-of-Concept
KEV Status: Not Listed
Impact: Unauthenticated Arbitrary File Read (Confidentiality: High)

Affected Systems

@logto/tunnel < 0.3.9
Logto deployments containing @logto/tunnel packages < 0.3.9
@logto/tunnel: < 0.3.9 (Fixed in: 0.3.9)

Code Analysis

Commit: 5686815

fix(tunnel): secure static file proxy path resolution against directory traversal

Mitigation Strategies

Upgrade @logto/tunnel to version 0.3.9 or higher.
Restrict network access to the tunnel port by binding exclusively to localhost.
Implement firewall rules to block untrusted external requests to the tunnel ports.

Remediation Steps:

Identify all environments executing @logto/tunnel.
Update package.json dependencies to target @logto/tunnel version 0.3.9 or higher.
Execute npm update @logto/tunnel or yarn upgrade @logto/tunnel to pull the fixed release.
Verify the server config enforces localhost-only bindings if deployed for local-only testing.

References

Read the full report for CVE-2026-63188 on our website for more details including interactive diagrams and full exploit analysis.