Bisheng
Monthly
Authenticated low-privileged users can read other users' and tenants' extracted document text in Bisheng through 3.0.0-beta4 by enumerating sequential file IDs against the GET /api/v1/knowledge/file_bbox endpoint, which lacks per-user ownership checks. This IDOR vulnerability (CWE-639) requires only a valid account on a network-reachable instance and poses a bounded confidentiality risk; no public exploit code or active exploitation has been identified at time of analysis. In multi-tenant deployments, the flaw can expose sensitive parsed documents across tenant boundaries.
Directory traversal in Bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 allows unauthenticated remote attackers to read arbitrary files from the server filesystem through the Linsight task-execution endpoint implemented in src/backend/bisheng/linsight/domain/task_exec.py. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates no authentication or user interaction is required against default configurations, with impact bounded to confidentiality - disclosure only, no code execution or file modification. Publicly available exploit code exists (SSVC exploitation status 'poc'; a public gist accompanies the report), but the vulnerability is not confirmed actively exploited (no CISA KEV entry), and EPSS is low at 0.33% (24th percentile), so priority should be driven by whether an organization actually exposes a Bisheng instance to untrusted networks.
Code injection in DataElement BiSheng 2.3.0, 2.4.0, and 2.4.0-beta1 allows unauthenticated network attackers to execute arbitrary code and fully compromise affected deployments through the backend validation endpoint src/backend/bisheng/api/v1/validate.py. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, base 9.8) describes a remote, low-complexity, no-authentication attack that yields complete loss of confidentiality, integrity, and availability. Exploitation is not confirmed as active (not in CISA KEV), no public exploit identified at time of analysis, EPSS is 0.21% (10th percentile), and no fixed version is confirmed in the available data; a GitHub gist referenced in the record may contain further technical detail.
Unauthenticated SSRF in DataElement bisheng through 2.6.0-fix2 exposes internal network services and cloud metadata endpoints to any internet-accessible attacker. The POST /api/v1/workflow/report/callback endpoint applies no authentication, no URL scheme restrictions, and no host filtering, allowing arbitrary server-side HTTP requests whose responses are retrievable from object storage via caller-controlled object names - enabling cloud credential theft (e.g., AWS IMDSv1 role keys) and internal network enumeration. No public exploit code has been identified and this CVE is not in CISA KEV at time of analysis.
Remote code execution in BISHENG's workflow engine (versions before 2.6.0) allows any authenticated user to submit crafted Code node definitions to the POST /api/v1/workflow/run_once endpoint, where they are evaluated via Python's exec() built-in without sandboxing or process isolation. Successful exploitation grants full server-side code execution with access to the host filesystem, stored credentials, and internal network resources reachable from the BISHENG backend process. No public exploit or CISA KEV listing has been identified at time of analysis, but the low-complexity, authenticated network attack path represents a critical risk especially in multi-tenant or shared-access deployments.
Authenticated low-privileged users can read other users' and tenants' extracted document text in Bisheng through 3.0.0-beta4 by enumerating sequential file IDs against the GET /api/v1/knowledge/file_bbox endpoint, which lacks per-user ownership checks. This IDOR vulnerability (CWE-639) requires only a valid account on a network-reachable instance and poses a bounded confidentiality risk; no public exploit code or active exploitation has been identified at time of analysis. In multi-tenant deployments, the flaw can expose sensitive parsed documents across tenant boundaries.
Directory traversal in Bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 allows unauthenticated remote attackers to read arbitrary files from the server filesystem through the Linsight task-execution endpoint implemented in src/backend/bisheng/linsight/domain/task_exec.py. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates no authentication or user interaction is required against default configurations, with impact bounded to confidentiality - disclosure only, no code execution or file modification. Publicly available exploit code exists (SSVC exploitation status 'poc'; a public gist accompanies the report), but the vulnerability is not confirmed actively exploited (no CISA KEV entry), and EPSS is low at 0.33% (24th percentile), so priority should be driven by whether an organization actually exposes a Bisheng instance to untrusted networks.
Code injection in DataElement BiSheng 2.3.0, 2.4.0, and 2.4.0-beta1 allows unauthenticated network attackers to execute arbitrary code and fully compromise affected deployments through the backend validation endpoint src/backend/bisheng/api/v1/validate.py. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, base 9.8) describes a remote, low-complexity, no-authentication attack that yields complete loss of confidentiality, integrity, and availability. Exploitation is not confirmed as active (not in CISA KEV), no public exploit identified at time of analysis, EPSS is 0.21% (10th percentile), and no fixed version is confirmed in the available data; a GitHub gist referenced in the record may contain further technical detail.
Unauthenticated SSRF in DataElement bisheng through 2.6.0-fix2 exposes internal network services and cloud metadata endpoints to any internet-accessible attacker. The POST /api/v1/workflow/report/callback endpoint applies no authentication, no URL scheme restrictions, and no host filtering, allowing arbitrary server-side HTTP requests whose responses are retrievable from object storage via caller-controlled object names - enabling cloud credential theft (e.g., AWS IMDSv1 role keys) and internal network enumeration. No public exploit code has been identified and this CVE is not in CISA KEV at time of analysis.
Remote code execution in BISHENG's workflow engine (versions before 2.6.0) allows any authenticated user to submit crafted Code node definitions to the POST /api/v1/workflow/run_once endpoint, where they are evaluated via Python's exec() built-in without sandboxing or process isolation. Successful exploitation grants full server-side code execution with access to the host filesystem, stored credentials, and internal network resources reachable from the BISHENG backend process. No public exploit or CISA KEV listing has been identified at time of analysis, but the low-complexity, authenticated network attack path represents a critical risk especially in multi-tenant or shared-access deployments.