Monthly
Arbitrary file read in EnergizeLab station-middleware Docker images 1.6.5 through 1.8.2 lets any registered low-privilege account supply a request parameter that the backend treats as a file path, resolving it without adequate restriction and returning files from outside the intended directories, which can expose middleware source, configuration and server secrets. Exploitation is remote and authenticated (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N in our independent assessment) and is confined to the listed Docker image versions; the CNA-published score of 9.9 (with scope change plus high integrity and availability impact) conflicts with our read-only impact assessment and should be reconciled before treating this as a top-tier emergency. No CISA KEV entry is present in the supplied data and no public exploit was identified at time of analysis, although the reference set includes a GitHub repository link that may contain a demonstration. Exposure risk is highest where container images carry secrets, tokens, or private keys on a filesystem reachable by the middleware process.
Local file disclosure in SimplePie through 1.9.0 lets a malicious or compromised feed server read files on the host running the PHP application: by replying to a feed request with an HTTP Location redirect - or by planting an autodiscovery <link> - that points at a file:// path, the library follows the reference and reads the target file into the parsed feed. Exploitation requires no privileges (PR:N) but does require the attacker to control the feed server's responses or inject a feed URL into the application (AC:H, AT:P), and disclosure is bounded to files readable by the web-server process. Vendor fix is available via upstream PR 991, public exploit code exists (a PoC targeting pfSense's RSS widget has been published), and no confirmed active exploitation (CISA KEV) was identified at time of analysis.
Unauthenticated remote attackers can delete arbitrary files from WordPress installations running the File Upload to Order plugin before 1.1.4, because the plugin's deletion routine trusts a file path taken from attacker-controlled session data and applies neither validation nor path confinement (CWE-73). The assessed vector (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H) confirms no authentication or user interaction is needed and that impact crosses the plugin's own security scope into the host WordPress installation, where deleting a file such as wp-config.php can escalate to full site compromise. Publicly available exploit code exists, but SSVC records no observed exploitation and EPSS remains low at 0.19% (8th percentile), so this is currently an easy-to-automate, high-impact integrity/availability risk rather than a confirmed active campaign.
Remote code execution in ONLYOFFICE Document Server affects every release before 10.0.0, allowing an attacker who holds a valid Inbox-compatible JWT to run arbitrary OS commands as the ds service account. The flaw lives in the Document Builder API: because the optional third argument of builder.SaveFile() accepts user-controlled converter XML, injecting a duplicate m_sFileTo element overrides the server-generated output path and lets the attacker write outside the designated job directory, overwrite runtime.json, and repoint the Document Builder executable so that commands execute during a subsequent job. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, but the CVSS 4.0 base score of 8.7 reflects high confidentiality, integrity, and availability impact, with exploitation gated on possession of a JWT signed with the deployment's secret (PR:L).
Elevation of privilege in the Windows Update servicing component allows an authenticated local attacker with low-level privileges to gain full SYSTEM-level control of the host by influencing a file name or path consumed by a privileged Update operation (CWE-73). The flaw is assessed at CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning it is not remotely reachable and requires a pre-existing local foothold, but once that foothold exists the escalation is low-complexity, requires no user interaction, and yields high confidentiality, integrity, and availability impact. CISA's SSVC assessment rates exploitation as "none" and automatable as "no"; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and a vendor patch is available. Affected systems include Windows 11 23H2, 24H2, 25H2, 26H1, and 26H2, plus Windows Server 2025 (including Server Core installations) running builds below the fixed thresholds.
Credential disclosure in Ivanti Xtraction (versions before 2026.4) allows an attacker holding a valid low-privileged authenticated account to manipulate a file name or path value the application uses, redirecting application-generated requests to an attacker-controlled endpoint and capturing EPMM connector credentials transmitted by the application. The flaw is network-reachable and requires only low privileges (CVSS:3.1/AV:N/AC:L/PR:L/UI:N), and because the vulnerable component crosses a trust boundary the scope is changed (S:C) with High confidentiality impact; no public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS data was not provided. Exposure is conditional: the credential-theft path only exists where Xtraction is configured with an EPMM connector that transmits credentials during request processing, so organizations not integrating Xtraction with EPMM are not exposed through this vector.
Arbitrary file read and write on the Metabase server is possible through H2-backed native queries and actions in Metabase 1.55.0 up to (but not including) 1.58.16, 1.59.13, 1.60.9, and 1.61.4. An authenticated user who has been granted permission to run native SQL queries or SQL actions can embed host-facing H2 built-in functions such as FILE_READ, FILE_WRITE, CSVREAD, CSVWRITE, and LINK_SCHEMA inside otherwise ordinary SELECT/CALL statements, allowing them to read or overwrite files on the Metabase host or attach external databases; because Metabase's default bundled sample database is H2, this attack surface is present in default installations without any extra configuration. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, but the fixed versions are published and the vulnerable privilege is a common analyst-level grant, making this a genuine high-priority issue rather than an inflated score.
Arbitrary file read in Frappe Framework versions before 15.117.0 and 16.x before 16.30.0 allows a user who can supply outgoing email HTML content to set an HTML attribute value pointing at a local server file path, which the framework then dereferences and exposes, disclosing server files readable by the Frappe service account. The flaw is remote and low-complexity but requires an authenticated account with enough privilege to author or configure outgoing email/notification content (CVSS vector PR:L, no victim user interaction), so its impact is confined to information disclosure of the service account's readable files rather than code execution or data modification; the vendor advisory GHSA-8v98-cfpm-9p67 and VulnCheck advisory describe the fix, and no public exploit code has been identified at time of analysis.
Authenticated file read in ConvertX through 0.19.0 allows any logged-in user to retrieve arbitrary files from the server by uploading a crafted reStructuredText document that uses an include directive pointing at an absolute path, converting it, and downloading the generated output. The flaw exists because the Pandoc converter wrapper in src/converters/pandoc.ts invokes Pandoc without the --sandbox flag, so Pandoc's own file-inclusion behavior is left unrestricted; the CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N, high confidentiality only) confirms remote exploitation requires valid credentials and does not affect integrity or availability. There is no public exploit identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), so this is a credible but moderate-priority information-disclosure risk whose real severity depends on what the ConvertX/Pandoc process user can reach on the host.
An arbitrary file-move flaw in the WebTools management interface of Brocade Fabric OS (all builds before 9.2.2d and 10.0.0 through 10.0.0a1) lets a high-privileged, authenticated administrator supply a crafted status-file path during a configuration transfer so that the underlying process relocates an arbitrary system file into a predictable, world-readable temporary directory. Successful exploitation yields high confidentiality and integrity impact on the switch - leaking sensitive configuration or credential material and destroying/misplacing critical system files - and can cause persistent denial of service, though the CVSS 4.0 vector (AV:A/PR:H, with no vulnerable-system availability impact scored) and the independent assessment agree the attack is confined to the management plane and requires both adjacent/management-network reach and a valid admin account. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score supplied; the practical risk is access-gated rather than a drive-by or internet-facing threat, and segregated or already-patched management networks are not exposed.
Arbitrary file read in EnergizeLab station-middleware Docker images 1.6.5 through 1.8.2 lets any registered low-privilege account supply a request parameter that the backend treats as a file path, resolving it without adequate restriction and returning files from outside the intended directories, which can expose middleware source, configuration and server secrets. Exploitation is remote and authenticated (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N in our independent assessment) and is confined to the listed Docker image versions; the CNA-published score of 9.9 (with scope change plus high integrity and availability impact) conflicts with our read-only impact assessment and should be reconciled before treating this as a top-tier emergency. No CISA KEV entry is present in the supplied data and no public exploit was identified at time of analysis, although the reference set includes a GitHub repository link that may contain a demonstration. Exposure risk is highest where container images carry secrets, tokens, or private keys on a filesystem reachable by the middleware process.
Local file disclosure in SimplePie through 1.9.0 lets a malicious or compromised feed server read files on the host running the PHP application: by replying to a feed request with an HTTP Location redirect - or by planting an autodiscovery <link> - that points at a file:// path, the library follows the reference and reads the target file into the parsed feed. Exploitation requires no privileges (PR:N) but does require the attacker to control the feed server's responses or inject a feed URL into the application (AC:H, AT:P), and disclosure is bounded to files readable by the web-server process. Vendor fix is available via upstream PR 991, public exploit code exists (a PoC targeting pfSense's RSS widget has been published), and no confirmed active exploitation (CISA KEV) was identified at time of analysis.
Unauthenticated remote attackers can delete arbitrary files from WordPress installations running the File Upload to Order plugin before 1.1.4, because the plugin's deletion routine trusts a file path taken from attacker-controlled session data and applies neither validation nor path confinement (CWE-73). The assessed vector (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H) confirms no authentication or user interaction is needed and that impact crosses the plugin's own security scope into the host WordPress installation, where deleting a file such as wp-config.php can escalate to full site compromise. Publicly available exploit code exists, but SSVC records no observed exploitation and EPSS remains low at 0.19% (8th percentile), so this is currently an easy-to-automate, high-impact integrity/availability risk rather than a confirmed active campaign.
Remote code execution in ONLYOFFICE Document Server affects every release before 10.0.0, allowing an attacker who holds a valid Inbox-compatible JWT to run arbitrary OS commands as the ds service account. The flaw lives in the Document Builder API: because the optional third argument of builder.SaveFile() accepts user-controlled converter XML, injecting a duplicate m_sFileTo element overrides the server-generated output path and lets the attacker write outside the designated job directory, overwrite runtime.json, and repoint the Document Builder executable so that commands execute during a subsequent job. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, but the CVSS 4.0 base score of 8.7 reflects high confidentiality, integrity, and availability impact, with exploitation gated on possession of a JWT signed with the deployment's secret (PR:L).
Elevation of privilege in the Windows Update servicing component allows an authenticated local attacker with low-level privileges to gain full SYSTEM-level control of the host by influencing a file name or path consumed by a privileged Update operation (CWE-73). The flaw is assessed at CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning it is not remotely reachable and requires a pre-existing local foothold, but once that foothold exists the escalation is low-complexity, requires no user interaction, and yields high confidentiality, integrity, and availability impact. CISA's SSVC assessment rates exploitation as "none" and automatable as "no"; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and a vendor patch is available. Affected systems include Windows 11 23H2, 24H2, 25H2, 26H1, and 26H2, plus Windows Server 2025 (including Server Core installations) running builds below the fixed thresholds.
Credential disclosure in Ivanti Xtraction (versions before 2026.4) allows an attacker holding a valid low-privileged authenticated account to manipulate a file name or path value the application uses, redirecting application-generated requests to an attacker-controlled endpoint and capturing EPMM connector credentials transmitted by the application. The flaw is network-reachable and requires only low privileges (CVSS:3.1/AV:N/AC:L/PR:L/UI:N), and because the vulnerable component crosses a trust boundary the scope is changed (S:C) with High confidentiality impact; no public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS data was not provided. Exposure is conditional: the credential-theft path only exists where Xtraction is configured with an EPMM connector that transmits credentials during request processing, so organizations not integrating Xtraction with EPMM are not exposed through this vector.
Arbitrary file read and write on the Metabase server is possible through H2-backed native queries and actions in Metabase 1.55.0 up to (but not including) 1.58.16, 1.59.13, 1.60.9, and 1.61.4. An authenticated user who has been granted permission to run native SQL queries or SQL actions can embed host-facing H2 built-in functions such as FILE_READ, FILE_WRITE, CSVREAD, CSVWRITE, and LINK_SCHEMA inside otherwise ordinary SELECT/CALL statements, allowing them to read or overwrite files on the Metabase host or attach external databases; because Metabase's default bundled sample database is H2, this attack surface is present in default installations without any extra configuration. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, but the fixed versions are published and the vulnerable privilege is a common analyst-level grant, making this a genuine high-priority issue rather than an inflated score.
Arbitrary file read in Frappe Framework versions before 15.117.0 and 16.x before 16.30.0 allows a user who can supply outgoing email HTML content to set an HTML attribute value pointing at a local server file path, which the framework then dereferences and exposes, disclosing server files readable by the Frappe service account. The flaw is remote and low-complexity but requires an authenticated account with enough privilege to author or configure outgoing email/notification content (CVSS vector PR:L, no victim user interaction), so its impact is confined to information disclosure of the service account's readable files rather than code execution or data modification; the vendor advisory GHSA-8v98-cfpm-9p67 and VulnCheck advisory describe the fix, and no public exploit code has been identified at time of analysis.
Authenticated file read in ConvertX through 0.19.0 allows any logged-in user to retrieve arbitrary files from the server by uploading a crafted reStructuredText document that uses an include directive pointing at an absolute path, converting it, and downloading the generated output. The flaw exists because the Pandoc converter wrapper in src/converters/pandoc.ts invokes Pandoc without the --sandbox flag, so Pandoc's own file-inclusion behavior is left unrestricted; the CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N, high confidentiality only) confirms remote exploitation requires valid credentials and does not affect integrity or availability. There is no public exploit identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), so this is a credible but moderate-priority information-disclosure risk whose real severity depends on what the ConvertX/Pandoc process user can reach on the host.
An arbitrary file-move flaw in the WebTools management interface of Brocade Fabric OS (all builds before 9.2.2d and 10.0.0 through 10.0.0a1) lets a high-privileged, authenticated administrator supply a crafted status-file path during a configuration transfer so that the underlying process relocates an arbitrary system file into a predictable, world-readable temporary directory. Successful exploitation yields high confidentiality and integrity impact on the switch - leaking sensitive configuration or credential material and destroying/misplacing critical system files - and can cause persistent denial of service, though the CVSS 4.0 vector (AV:A/PR:H, with no vulnerable-system availability impact scored) and the independent assessment agree the attack is confined to the management plane and requires both adjacent/management-network reach and a valid admin account. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score supplied; the practical risk is access-gated rather than a drive-by or internet-facing threat, and segregated or already-patched management networks are not exposed.