Unauthenticated read-access exposure in Oracle Hyperion Financial Management 11.2.25.0.000 allows remote attackers to retrieve a subset of application data via HTTP without any credentials. The flaw resides in the Security component and is tagged as an Authentication Bypass, meaning the component fails to enforce proper access controls on at least one HTTP-accessible endpoint. No public exploit code or confirmed active exploitation has been identified at time of analysis, though the trivial attack conditions (AC:L/PR:N/UI:N) lower the bar for opportunistic reconnaissance.
Unauthenticated network exposure in Oracle Database Server's RDBMS component allows remote attackers to read a subset of database-accessible data via Oracle Net without any credentials. Affected across three major release trains - 19c (19.3-19.32), 21c (21.3-21.23), and 23ai (23.4.0-23.26.3) - the flaw is tagged as an authentication bypass, suggesting the Oracle Net listener or a pre-auth code path fails to enforce access controls before returning data. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero authentication requirement make this straightforward to attempt at scale.
Unauthenticated network access to Oracle Agile PLM MCAD Connector 3.6 exposes a subset of data managed by the CAX Client component over plain HTTP, with no privileges or user interaction required. Classified as an authentication bypass (EUVD-2026-62021) and described as 'easily exploitable' in Oracle's CSPU August 2026 advisory, this vulnerability carries a CVSS 3.1 score of 5.3 with purely confidentiality impact and no integrity or availability risk. No public exploit code or active exploitation has been identified at time of analysis.
Unauthorized read access to Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by unauthenticated remote attackers over HTTP, exploiting a flaw in the product's Security component tagged as an authentication bypass. The CVSS 5.3 vector (AV:N/AC:L/PR:N/UI:N) confirms low-complexity, zero-privilege exploitation with no user interaction required, limited to partial confidentiality loss. No confirmed active exploitation (CISA KEV) and no public exploit code have been identified at time of analysis, placing this in the moderate-priority remediation category despite the sensitivity of financial consolidation data.
Unauthorized read access to Oracle Hyperion Financial Reporting 11.2.25.0.000 is achievable by unauthenticated remote attackers via HTTP, with no user interaction or special configuration required. The vulnerability is tagged as an authentication bypass in the Server component, allowing exposure of a subset of Financial Reporting data. No public exploit or CISA KEV listing has been identified at time of analysis, but the low-complexity, no-authentication attack vector makes it straightforward to leverage opportunistically.
Unauthorized read access to a subset of data is possible in Oracle Helidon 3.2.18's Imperative Web Server component via unauthenticated HTTPS network requests. Tagged as an Authentication Bypass, this flaw allows a remote unauthenticated attacker with network reach to the affected service to circumvent access controls and retrieve restricted information without any credentials or user interaction. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog, though the low attack complexity and zero-privilege requirement make it accessible to unsophisticated attackers.
Unauthenticated read access to Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is achievable by remote attackers over HTTP via a flaw in the Installation and Configuration component. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the vulnerability is easily exploitable with no authentication, no user interaction, and no special network position required - Oracle's own advisory characterizes it as 'easily exploitable.' Impact is limited to unauthorized read access to a subset of Hyperion-accessible data, with no integrity or availability consequences. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Unauthenticated information disclosure in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 exposes a subset of accessible data to remote attackers over HTTP without requiring any credentials. The vulnerability resides in the Installation and Configuration component and is classified by Oracle as an authentication bypass, meaning the access control mechanism protecting configuration-related data can be circumvented without any prior authentication. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, though the low-complexity, unauthenticated attack vector lowers the barrier for opportunistic exploitation.
Unauthorized read access in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is exposed via an authentication bypass in the Installation and Configuration component, reachable over HTTP without credentials. An unauthenticated remote attacker can exploit this to read a subset of data accessible to the affected component, potentially including configuration or operational metadata. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Unauthenticated information disclosure in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 exposes the Common Events component to remote attackers over HTTP with no credentials, privileges, or user interaction required. The authentication bypass - flagged explicitly by Oracle's security team (secalert_us@oracle.com) - allows attackers to read a subset of platform data accessible to the component. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the zero-complexity attack vector makes opportunistic reconnaissance straightforward for any attacker with network access to the Hyperion server.
Denial-of-service in Oracle Hyperion Financial Management 11.2.25.0.000 allows a low-privileged, network-adjacent attacker to cause the application to hang or crash repeatedly via crafted HTTP requests targeting the Security component. The flaw is rated Medium (CVSS 5.3) due to high attack complexity, meaning exploitation requires specific conditions to be met beyond simply having network access. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog at time of analysis.
Schema validation bypass in fastify before version 5.12.1 allows authenticated network attackers to submit request bodies that circumvent type enforcement when schemas target root-level primitive values. When Ajv coerces a submitted JSON string to match an expected integer or other primitive type during validation, fastify fails to propagate the coerced value back to the route handler, which instead receives the original unvalidated string. No public exploit code has been identified at time of analysis, but the flaw directly undermines integrity and access-control logic in any application that relies on schema-validated primitive types for authorization or business-rule decisions.
Unauthenticated read access to VReplication log data in Vitess vttablet (versions 24.0.2 and earlier) exposes raw SQL statements and bound application parameter values to any caller who can reach the debug HTTP port. The `/debug/vrlog` endpoint, registered via `addHttpEndpoint()` in `go/vt/vttablet/tabletmanager/vreplication/vrlog.go`, invokes `vrlogStatsHandler()` without the `acl.CheckAccessHTTP(r, acl.DEBUGGING)` guard applied to every comparable debug endpoint, violating the operator-configured security policy. Critically, the feature is disabled by default since v22 and requires explicit opt-in via `--vreplication-enable-http-log`, which materially limits real-world exposure; no public exploit has been identified and the CVE is not listed in CISA KEV.
Mail header injection in MyBB's Email User feature (prior to 1.8.40) allows CRLF sequences embedded in the unsanitized `fromname` HTTP parameter to inject arbitrary SMTP headers - including Bcc, Reply-To, and Return-Path - into outgoing forum emails. The attack surface is conditional on two prerequisites: the `mail_handler` must be set to PHP (the default) and the `cansendemail` group permission must be enabled for the attacker's user group, including guests for the unauthenticated path. No public exploit code exists and this vulnerability is not listed in CISA KEV, but successful exploitation turns the forum's mail infrastructure into a phishing or spam relay, weaponizing the forum's domain reputation against recipients.
Unauthenticated integrity compromise in Oracle Hyperion Calculation Manager 11.2.25.0.000 allows remote attackers via HTTP to perform unauthorized insert, update, or delete operations on accessible data without credentials. The vulnerability resides in the Security component of this enterprise performance management suite and is classified as easily exploitable per Oracle's advisory. No public exploit code or CISA KEV listing has been identified at time of analysis, but the authentication bypass tag and PR:N CVSS vector confirm no credential barrier exists for exploitation.
Partial denial of service in Oracle Helidon 4.5.3 is reachable by unauthenticated network attackers over HTTP, targeting the Imperative Web Server component within Oracle Fusion Middleware. Successful exploitation degrades availability without compromising confidentiality or integrity. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS score of 5.3 (Medium) reflects a bounded, availability-only impact.
Partial denial-of-service in Oracle Java SE's JSSE component allows unauthenticated remote attackers to degrade availability of applications using TLS APIs across a broad range of supported Java versions. Affected releases span Java SE 8 through 26, GraalVM for JDK 17 and 21, and GraalVM Enterprise Edition 21.3.19, making this a wide-blast-radius availability issue for the Java ecosystem. Exploitation is limited to availability impact only - no confidentiality or integrity compromise is possible - and no public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
Unauthorized data disclosure in Oracle Hyperion Financial Management 11.2.25.0.000 allows a low-privileged attacker with network access via HTTP to bypass security controls and gain complete read access to all data accessible within the application. The vulnerability resides in the Security component and is tagged as an authentication bypass, indicating weaknesses in how the application enforces authorization for authenticated sessions. No public exploit code has been identified and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, though the confidentiality impact is rated High, covering critical financial consolidation data.
Unauthenticated IDOR in the Razorpay for WooCommerce WordPress plugin (versions ≤ 4.8.7) allows remote attackers to manipulate order object references without any authentication, potentially bypassing payment authorization checks or modifying order state. Reported by Patchstack and corroborated by ENISA EUVD-2026-60817, this affects all WooCommerce stores running the vulnerable plugin versions with the Razorpay payment gateway active. No public exploit code or active exploitation has been identified at time of analysis, but the unauthenticated network vector with low attack complexity means opportunistic abuse requires minimal skill.
Zabbix frontend information disclosure via the `validatate.api.exists` action permits authenticated users to extract plaintext user macro values that are otherwise masked in the standard UI. Any account with Zabbix frontend access can invoke this API action to retrieve macro contents, which frequently include embedded credentials, SNMP community strings, API tokens, or other operational secrets. No public exploit or confirmed active exploitation has been identified at time of analysis, but the practical impact exceeds what the CVSS low-confidentiality rating implies when sensitive secrets are stored in macros.
Unauthorized share metadata disclosure in Pydio Cells 5.0.0-5.0.2 allows any authenticated standard-role user to retrieve confidential details for file shares they do not own. The REST handler for GET /a/share/link/{Uuid} in idm/share/rest/handler.go omits the MatchPolicies authorization step present in its sibling endpoint, and the missing policy query propagates through the entire call stack down to the workspace service, which then applies no access-control filter. A successful request exposes the link hash and URL, the share owner's user identifier, the hidden share-user login, the full permission set, download limits and counts, recipient lists, expiry date, and the password-required flag. No public exploit has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Heap memory exhaustion in ArcadeDB's Cypher query engine allows authenticated users to trigger OutOfMemoryError and cause temporary service unavailability. Attackers with valid database credentials can submit crafted Cypher range() expressions with abnormally large bounds, consuming server heap until the JVM is starved of resources. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; the authenticated prerequisite meaningfully limits attacker pool.
The LDAP Source debug API endpoint in authentik, an open-source identity provider, omits the object-level read-authorization filter present on the rest of the API prior to versions 2026.2.6 and 2026.5.5, enabling unauthenticated callers to retrieve LDAP directory metadata from any configured LDAP Source. Any network-reachable client can invoke the diagnostic action, causing the authentik server to connect to the upstream directory with its stored bind credentials and return a bounded set of distinguished names and attribute names - exposing account and group naming conventions and directory structure without disclosing attribute values. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog.
Unauthorized data exposure in Oracle Hyperion Calculation Manager version 11.2.25.0.000 allows unauthenticated remote attackers to read a subset of application-accessible data via HTTP, exploiting an authentication bypass in the Security component. The CVSS 3.1 score of 5.3 (Medium) reflects low-complexity, no-privilege-required network exploitation with limited confidentiality impact and no integrity or availability consequences. No public exploit code has been identified and this CVE does not appear on the CISA Known Exploited Vulnerabilities catalog at time of analysis.
Authorization bypass in EdoWEB (all versions before 780-g7) by Netiket Information Technologies allows authenticated low-privileged users to access ACL-restricted functionality and data by manipulating user-controlled keys. The flaw is rooted in CWE-639 (Insecure Direct Object Reference), where the application trusts a client-supplied key without verifying the requesting user's authorization to the referenced object. No public exploit has been identified at time of analysis, and no CISA KEV listing exists; exploitation is constrained by high attack complexity and a required authenticated session.
Confidentiality compromise in Oracle Hyperion Calculation Manager 11.2.25.0.000 allows unauthenticated remote attackers to gain unauthorized access to critical or complete data accessible within the application via HTTP. The attack vector is network-based but requires high attack complexity and human interaction from a victim other than the attacker, limiting opportunistic exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis, though the Authentication Bypass tag suggests the underlying flaw bypasses access controls in the Security component.
Unauthorized read access to data in Oracle Helidon 4.5.1's Imperative Web Server component is achievable by unauthenticated network attackers via HTTP, exploiting what the vendor tags as an authentication bypass condition. The affected version is precisely 4.5.1 of Oracle's Java microservices framework, and the vulnerability exposes a subset of data accessible to the server without requiring any credentials or user interaction. No public exploit has been identified at time of analysis, and Oracle has disclosed this issue as part of its August 2026 Critical Patch Update.
Unauthorized read access to application data is achievable against Oracle Helidon 4.5.1's Imperative Web Server component via unauthenticated HTTP requests. The vulnerability, tagged as an Authentication Bypass, allows remote attackers with network access to retrieve a subset of data without credentials, as confirmed by the CVSS vector (AV:N/AC:L/PR:N/UI:N). No public exploit has been identified at time of analysis, and the issue is addressed in Oracle's Critical Patch Update for August 2026.
Unauthorized data disclosure in Oracle Helidon 4.5.0 affects the Imperative Web Server component, enabling unauthenticated network attackers to read a subset of accessible application data via HTTP. Tagged as an authentication bypass, the flaw requires no privileges or user interaction, making it trivially reachable from any network vantage point. No public exploit code has been identified and this CVE does not appear in the CISA KEV catalog at time of analysis, though its zero-authentication, low-complexity profile warrants timely patching in network-exposed deployments.
Unauthorized data read in Oracle Helidon 3.2.18 allows unauthenticated remote attackers to access a subset of data served by the Imperative Web Server component over HTTP, with no credentials or user interaction required. Tagged as an Authentication Bypass by Oracle CERT, the flaw is classified as 'easily exploitable' in Oracle's August 2026 Critical Patch Update advisory. No public exploit code or active exploitation has been identified at time of analysis, but the absence of any authentication prerequisite lowers the bar for opportunistic reconnaissance.
Unauthorized data read in Oracle Agile PLM MCAD Connector 3.6 exposes a subset of PLM-accessible data to unauthenticated remote attackers via HTTP against the CAX Client component. Tagged explicitly as an Authentication Bypass, the flaw allows any network-reachable attacker to query protected PLM data without credentials, indicating that the CAX Client HTTP interface fails to enforce authentication on at least one data-serving endpoint. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the trivially low attack complexity (AV:N/AC:L/PR:N/UI:N) means exploitation requires no special tooling.
Sensitive data exposure in the Shortcodes and Extra Features for Phlox Theme WordPress plugin (versions up to and including 2.17.22) allows unauthenticated remote attackers to retrieve sensitive information without credentials via network requests. The flaw is rooted in CWE-201, where the plugin inserts sensitive information into data sent to requestors without enforcing access controls, making it passively collectible by any actor who reaches the affected endpoint. No public exploit code or active exploitation in CISA KEV has been identified at time of analysis, though the zero-barrier entry point (AV:N/AC:L/PR:N/UI:N) makes opportunistic scanning a realistic threat vector.
Unauthenticated sensitive data exposure in the 3D FlipBook - PDF Flipbook Viewer, Flipbook Image Gallery WordPress plugin (versions ≤ 1.16.20) allows remote unauthenticated attackers to retrieve sensitive information without credentials or user interaction. Classified under CWE-497 and reported by Patchstack (EUVD-2026-60815), the flaw permits unauthorized parties to access data that should be confined to privileged or internal control spheres - likely via improperly access-controlled REST API or AJAX endpoints common in WordPress plugin architecture. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the low-complexity, no-authentication CVSS vector means exploitation would be trivial if targeted.
Confidentiality breach in Oracle Hyperion Financial Management 11.2.25.0.000 allows a low-privileged, network-authenticated attacker to gain complete read access to all data accessible within the application via HTTP, including sensitive financial consolidation records. The vulnerability resides in the Security component and carries an 'Authentication Bypass' classification, suggesting improper enforcement of authorization controls that permits privilege escalation beyond the attacker's intended access level. No public exploit code or CISA KEV listing has been identified at time of analysis, though the high attack complexity requirement indicates exploitation demands specific environmental or application-state conditions.
Unauthenticated remote data modification is possible in Oracle Helidon 3.2.19 via its Imperative Web Server component, exploitable over HTTP with no credentials or user interaction required. Successful exploitation allows an attacker to perform unauthorized insert, update, or delete operations on data accessible to the Helidon instance, with no confidentiality or availability impact. No public exploit code or active exploitation has been identified at time of analysis.
Cross-database information disclosure in ArcadeDB versions up to and including 26.7.3 allows any authenticated user to enumerate the full server database registry via the Raft cluster-info endpoints (GetClusterHandler and PostBootstrapStateHandler), which authenticate requests but perform no authorization check. Affected deployments are limited to HA clusters with arcadedb.ha.enabled configured and the ha-raft module loaded. Exposed metadata includes database names, last transaction IDs, bootstrap fingerprints, and cluster peer/leader topology - enabling cross-tenant reconnaissance in shared environments. No public exploit has been identified at time of analysis; vendor-released patch is available in version 26.8.1.
Insufficient access control on the /api/lute/spinBlockDOM endpoint in SiYuan before v3.7.4 allows any authenticated low-privilege user (RoleEditor or RoleReader) to invoke a DOM-transformation API that should be admin-only, and to trigger endpoint starvation by submitting large payloads that monopolize the per-path mutex. The CVSS 4.0 base score is 5.3 (Medium), reported by VulnCheck with a fix available in v3.7.4. No public exploit code or active exploitation has been identified at time of analysis.
Authorization bypass in ArcadeDB's MCP server-level set_server_setting tool allows authenticated read-only users to modify global server configuration in versions 26.4.2 through 26.7.3. SetServerSettingTool.execute() validates only the global allowAdmin flag and omits any role-level check, meaning any user with valid credentials - regardless of their assigned role - can invoke the tool when the MCP deployment is configured with allowAdmin=true and a non-root allowedUsers list. Successful exploitation enables configuration tampering of GlobalConfiguration or deliberate denial of service. No public exploit identified at time of analysis and this vulnerability is not listed in CISA KEV; the issue is fixed in 26.8.1.
Confidentiality compromise in Oracle Agile PLM MCAD Connector 3.6 (CAX Client component) allows an unauthenticated attacker with physical access to the local network segment to gain unauthorized access to all data accessible by the connector. The attack is adjacent-network and high-complexity, limiting realistic exposure to insider threats or attackers with pre-existing physical network presence. No public exploit code exists and no active exploitation has been confirmed; CVSS 5.3 reflects the constrained attack vector. The 'Authentication Bypass' tag suggests the vulnerability circumvents a credential or session-validation mechanism within the CAX Client, enabling direct data exposure without credential theft.
Zabbix Frontend's popup.testtriggerexpr action can be abused by unauthenticated adjacent-network attackers to cause disproportionate CPU load on the webserver, resulting in potential denial of service for monitoring operations. All Zabbix versions appear affected based on the wildcard CPE string. No public exploit has been identified at time of analysis, and the CVSS 4.0 score of 5.3 reflects moderate, realistic availability risk constrained to adjacent-network attackers with no confidentiality or integrity exposure.
Heap out-of-bounds write and read in libheif 1.23.0 and earlier allows an attacker who can supply a crafted HEIF/AVIF image sequence to corrupt heap memory during any application decode-then-re-encode workflow. The flaw stems from the uncompressed encoder allocating output buffers from primary image dimensions (e.g., 2x2) while copying each component plane using that plane's actual stored size (e.g., a mismatched 256x256 alpha plane), writing 65536 pixels worth of data into a 4-pixel allocation. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the fix commit includes a purpose-built regression test that directly reproduces the heap overflow, confirming the root cause.
Cross-site request forgery in SourceCodester Online Examination & Learning Management System 1.0 enables remote attackers to perform unauthorized state-changing actions on behalf of authenticated users by tricking them into visiting a crafted page or clicking a malicious link. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L) confirms the attack is network-initiated without attacker authentication, though victim interaction is required and impact is limited to partial integrity loss within the vulnerable system. No public exploit code or CISA KEV listing exists at time of analysis.
Oracle VM VirtualBox 7.2.14 Core component exposes a local confidentiality vulnerability enabling a high-privileged attacker with local infrastructure access to read critical data across VM isolation boundaries, with confirmed scope change indicating potential host or cross-VM data exposure. The CVSS vector (AV:L/AC:H/PR:H/S:C/C:H/I:N/A:N) reflects a narrow but impactful attack path constrained by high complexity and privilege prerequisites. No public exploit has been identified and this CVE does not appear in the CISA KEV catalog at time of analysis, placing it in a low-urgency tier for most environments despite the high confidentiality impact when scope change is considered.
Local privilege escalation in Oracle Hyperion Financial Reporting 11.2.25.0.000 allows a low-privileged attacker with logon access to the host infrastructure to perform unauthorized creation, deletion, or modification of critical data and read a subset of application data - consistent with an application-layer authentication bypass within the Server component. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog. The combination of local access requirement and high attack complexity substantially limits opportunistic exploitation, though the integrity impact is rated High by Oracle.
Integrity compromise and partial data disclosure in Oracle Hyperion Financial Reporting 11.2.25.0.000 exposes financial reporting data to a local low-privileged attacker who can, under high-complexity conditions, create, modify, or delete critical data and read a subset of accessible reporting records. The Server component is the affected entry point, and exploitation requires an established logon to the infrastructure host. No public exploit has been identified at time of analysis, and the CVSS 3.1 score of 5.3 (Medium) appropriately reflects the local access constraint and difficult exploitation conditions.
Integrity compromise in Oracle Hyperion Financial Management 11.2.25.0.000 allows a low-privileged local attacker - contingent on human interaction from a separate user - to perform unauthorized creation, deletion, or modification of critical financial consolidation data, with potential scope change impact on additional Oracle components. ENISA EUVD-2026-61861 tags this as involving Authentication Bypass within the Security component, though the specific mechanism is not disclosed in Oracle's advisory. No public exploit code exists and no CISA KEV listing is present at time of analysis.
NULL-pointer dereference in kin-openapi's request validation pipeline (versions 0.2.0 through 0.143.0) enables any unauthenticated remote client to crash request validation with a single crafted HTTP request. The defect resides in defaultContentParameterDecoder within openapi3filter/req_resp_decoder.go, where mt.Schema.Value is dereferenced without a nil guard when a content parameter's application/json media type declares no schema - a construct that is explicitly valid under both OpenAPI 3.0.x and 3.1.x, meaning doc.Validate() will not surface the issue at startup. Depending on integration depth, an attacker can cause either unbounded panic-log growth or a complete process crash; no public exploit or CISA KEV listing exists at time of analysis, and the vendor released a confirmed fix in v0.144.0.
Authorization bypass in Dolibarr ERP/CRM's clonetasks mass action allows authenticated users with project creation permissions to insert task records into private projects they are not authorized to access. An inverted boolean condition in the private-project membership check within actions_massactions.inc.php incorrectly grants authorization to non-members when it should deny them. The attacker controls the target via a user-supplied projectid POST parameter, making exploitation straightforward for any authenticated user with basic project permissions. No public exploit code has been identified at time of analysis, and a vendor patch is available via upstream commit.
Keycloak's authorization services group policy provider grants unauthorized access to protected resources by matching group membership using only group names in tokens rather than full hierarchical paths. Authenticated users whose account belongs to a same-named but structurally distinct group can be silently elevated to the permissions of an authorized group, bypassing fine-grained access controls. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the integrity impact is rated High given the policy bypass directly subverts resource access decisions.
Path traversal in Blueprint Studio prior to 2.5.2 allows an authenticated Home Assistant administrator to escape the intended configuration directory boundary via the legacy terminal command execution path. By supplying an arbitrary `cwd` working-directory parameter, the administrator can direct terminal commands to any host path accessible to the Home Assistant container process, reading or modifying files outside the HA config root. No public exploit identified at time of analysis; the CVSS 4.0 score of 5.1 reflects the high privilege requirement (PR:H), and exploitation is strictly bounded by container filesystem permissions.