Anagnorisis
Monthly
Cross-site scripting (XSS) in volotat Anagnorisis up to 0.4.11 allows an authenticated low-privilege attacker to inject script through a crafted media filename or file_path argument processed by the PlaylistManager.js html function, with execution occurring when a victim views the affected playlist or media entry. Publicly available exploit code exists, and the vendor was contacted but did not respond, so no vendor-released patch has been identified. The CVSS 4.0 base score is 5.1 (MEDIUM) with PR:L and UI:P, limiting impact to same-origin actions and low integrity manipulation.
Path traversal in volotat Anagnorisis through 0.4.2 allows an authenticated remote attacker to use the get_file_content, save_file_content, move_files, and start_streaming handlers in page.html to escape the intended media directory, enabling limited file disclosure and arbitrary file modification or relocation. The vendor was contacted but did not respond, no fixed version is identified, and publicly available exploit code exists. This is a medium-severity issue (VulDB CVSS 4.0 5.3; independent CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) affecting self-hosted instances where an attacker can obtain valid credentials.
Missing authentication in the volotat Anagnorisis Socket.IO Connect interface exposed through app.py lets any remote party able to reach the service interact with the endpoint without credentials, producing limited confidentiality, integrity and availability impact. The issue affects versions up to 0.3.1/0.4.0, requires no user interaction or privileges (PR:N/UI:N in both the CVSS 4.0 and the independently assessed CVSS 3.1 vectors), and publicly available exploit code exists, though there is no confirmation of active exploitation (CISA KEV). Risk is best described as low-to-moderate in practice: the project is a niche, typically self-hosted application, the endpoint must be network-reachable, and the assessed impact is capped at Low across C/I/A.
Cross-site scripting (XSS) in volotat Anagnorisis up to 0.4.11 allows an authenticated low-privilege attacker to inject script through a crafted media filename or file_path argument processed by the PlaylistManager.js html function, with execution occurring when a victim views the affected playlist or media entry. Publicly available exploit code exists, and the vendor was contacted but did not respond, so no vendor-released patch has been identified. The CVSS 4.0 base score is 5.1 (MEDIUM) with PR:L and UI:P, limiting impact to same-origin actions and low integrity manipulation.
Path traversal in volotat Anagnorisis through 0.4.2 allows an authenticated remote attacker to use the get_file_content, save_file_content, move_files, and start_streaming handlers in page.html to escape the intended media directory, enabling limited file disclosure and arbitrary file modification or relocation. The vendor was contacted but did not respond, no fixed version is identified, and publicly available exploit code exists. This is a medium-severity issue (VulDB CVSS 4.0 5.3; independent CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) affecting self-hosted instances where an attacker can obtain valid credentials.
Missing authentication in the volotat Anagnorisis Socket.IO Connect interface exposed through app.py lets any remote party able to reach the service interact with the endpoint without credentials, producing limited confidentiality, integrity and availability impact. The issue affects versions up to 0.3.1/0.4.0, requires no user interaction or privileges (PR:N/UI:N in both the CVSS 4.0 and the independently assessed CVSS 3.1 vectors), and publicly available exploit code exists, though there is no confirmation of active exploitation (CISA KEV). Risk is best described as low-to-moderate in practice: the project is a niche, typically self-hosted application, the endpoint must be network-reachable, and the assessed impact is capped at Low across C/I/A.