Alchemy Cms
Monthly
Alchemy CMS versions prior to 7.4.15, 8.0.15, 8.1.14, and 8.2.6 expose an unauthenticated API endpoint (GET /api/pages/nested) that returns the complete page tree without any authorization check, leaking restricted (member-only) and unpublished draft page metadata to anonymous callers. Appending the elements=true parameter causes PageTreeSerializer to additionally dump element and ingredient content from those restricted pages, fully bypassing the access control enforced by the sibling show and index actions. The vendor advisory includes working reproduction steps, and SSVC records that proof-of-concept exploitation is available and automatable, though no CISA KEV listing or EPSS score was supplied.
Unauthenticated information disclosure in AlchemyCMS affects all 7.x versions before 7.4.16 and all 8.x versions before 8.3.6 via the GET /api/nodes REST endpoint, which returned the full navigation node dataset without any authorization check. Any network-reachable attacker could enumerate restricted page names, internal URL paths, and cross-site navigation structures across all languages. No public exploit identified at time of analysis, but the attack requires only a single unauthenticated HTTP request, making automated scanning trivial.
Arbitrary code execution in Alchemy CMS before versions 7.4.12 and 8.0.3 stems from unsafe use of Ruby's eval() function on the resource_handler.engine_name parameter in the ResourcesHelper class. An authenticated administrator can manipulate module configurations to inject and execute arbitrary system commands with the privileges of the Ruby process. The vulnerability requires high privileges and careful setup to exploit, but completely bypasses the Ruby sandbox once successful.
A Stored XSS vulnerability has been discovered in version 4.1.0 of AlchemyCMS via the /admin/pictures image field. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Alchemy CMS versions prior to 7.4.15, 8.0.15, 8.1.14, and 8.2.6 expose an unauthenticated API endpoint (GET /api/pages/nested) that returns the complete page tree without any authorization check, leaking restricted (member-only) and unpublished draft page metadata to anonymous callers. Appending the elements=true parameter causes PageTreeSerializer to additionally dump element and ingredient content from those restricted pages, fully bypassing the access control enforced by the sibling show and index actions. The vendor advisory includes working reproduction steps, and SSVC records that proof-of-concept exploitation is available and automatable, though no CISA KEV listing or EPSS score was supplied.
Unauthenticated information disclosure in AlchemyCMS affects all 7.x versions before 7.4.16 and all 8.x versions before 8.3.6 via the GET /api/nodes REST endpoint, which returned the full navigation node dataset without any authorization check. Any network-reachable attacker could enumerate restricted page names, internal URL paths, and cross-site navigation structures across all languages. No public exploit identified at time of analysis, but the attack requires only a single unauthenticated HTTP request, making automated scanning trivial.
Arbitrary code execution in Alchemy CMS before versions 7.4.12 and 8.0.3 stems from unsafe use of Ruby's eval() function on the resource_handler.engine_name parameter in the ResourcesHelper class. An authenticated administrator can manipulate module configurations to inject and execute arbitrary system commands with the privileges of the Ruby process. The vulnerability requires high privileges and careful setup to exploit, but completely bypasses the Ruby sandbox once successful.
A Stored XSS vulnerability has been discovered in version 4.1.0 of AlchemyCMS via the /admin/pictures image field. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.