Fastschema
Monthly
Remote unauthenticated account takeover in fastschema through v0.15.1 is enabled by a TOCTOU race condition in the OTP-based account recovery flow. The verifyOTPSession function in pkg/auth/local.go reads and increments the attempt counter in separate non-atomic operations, allowing concurrent HTTP requests to race past the attempt limit before any counter update is committed. With no effective limit enforced on a 6-digit OTP (1,000,000 possible values), an attacker can brute-force valid codes; no public exploit is identified at time of analysis and this CVE is not in CISA KEV.
Stored XSS in fastschema through v0.15.1 permits any low-privileged authenticated user to store a script-bearing SVG file in the application's web root by spoofing the HTTP Content-Type header during upload. The root cause is that the PutMultipart function in pkg/rclonefs/base.go trusts the client-supplied Content-Type value rather than inspecting actual file bytes, allowing an attacker to rename an SVG to .jpg while declaring image/svg+xml and fully bypass the MIME allow-list. When a privileged user later browses to the stored file URL, the browser renders the SVG and executes the embedded JavaScript in that user's session context - a scope-changing impact that elevates the real-world risk above what the medium CVSS score alone suggests. No public exploit has been identified at time of analysis.
NULL pointer dereference in fastschema through v0.15.1 enables an unauthenticated remote attacker to crash the entire server process with a single HTTP request targeting the password-recovery endpoint. The flaw originates in the sendOTPEmail function in pkg/auth/local.go, which dereferences a pointer from an unchecked error path without nil validation, triggering a fatal Go panic that terminates the server. No public exploit or CISA KEV listing has been identified at time of analysis, but the trivial exploitation path (no authentication, no special configuration, single request) makes this a high-priority availability risk for any internet-exposed fastschema deployment.
Remote unauthenticated account takeover in fastschema through v0.15.1 is enabled by a TOCTOU race condition in the OTP-based account recovery flow. The verifyOTPSession function in pkg/auth/local.go reads and increments the attempt counter in separate non-atomic operations, allowing concurrent HTTP requests to race past the attempt limit before any counter update is committed. With no effective limit enforced on a 6-digit OTP (1,000,000 possible values), an attacker can brute-force valid codes; no public exploit is identified at time of analysis and this CVE is not in CISA KEV.
Stored XSS in fastschema through v0.15.1 permits any low-privileged authenticated user to store a script-bearing SVG file in the application's web root by spoofing the HTTP Content-Type header during upload. The root cause is that the PutMultipart function in pkg/rclonefs/base.go trusts the client-supplied Content-Type value rather than inspecting actual file bytes, allowing an attacker to rename an SVG to .jpg while declaring image/svg+xml and fully bypass the MIME allow-list. When a privileged user later browses to the stored file URL, the browser renders the SVG and executes the embedded JavaScript in that user's session context - a scope-changing impact that elevates the real-world risk above what the medium CVSS score alone suggests. No public exploit has been identified at time of analysis.
NULL pointer dereference in fastschema through v0.15.1 enables an unauthenticated remote attacker to crash the entire server process with a single HTTP request targeting the password-recovery endpoint. The flaw originates in the sendOTPEmail function in pkg/auth/local.go, which dereferences a pointer from an unchecked error path without nil validation, triggering a fatal Go panic that terminates the server. No public exploit or CISA KEV listing has been identified at time of analysis, but the trivial exploitation path (no authentication, no special configuration, single request) makes this a high-priority availability risk for any internet-exposed fastschema deployment.