Ladybug
Monthly
Remote code execution in Ladybug (wearefrank/ladybug) versions prior to 3.0-20251107.114628 allows network attackers with low-level privileges to execute arbitrary code by uploading crafted gzip-compressed XML payloads to the /iaf/ladybug/api/report/{storage} or /iaf/ladybug/api/report/upload endpoints, which are then unsafely deserialized. This is a CWE-502 deserialization of untrusted data issue with a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and publicly available exploit code exists, though EPSS indicates a low probability of exploitation (0.33%, 24th percentile). No user interaction is required, and the vendor has released a patch in version 3.0-20251107.114628.
Remote code execution in Ladybug (wearefrank/ladybug) versions prior to 3.0-20251107.114628 allows network attackers with low-level privileges to execute arbitrary code by uploading crafted gzip-compressed XML payloads to the /iaf/ladybug/api/report/{storage} or /iaf/ladybug/api/report/upload endpoints, which are then unsafely deserialized. This is a CWE-502 deserialization of untrusted data issue with a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and publicly available exploit code exists, though EPSS indicates a low probability of exploitation (0.33%, 24th percentile). No user interaction is required, and the vendor has released a patch in version 3.0-20251107.114628.