Slink
Monthly
Missing authorization on image comment endpoints in Slink before 1.12.3 exposes comment threads to unauthenticated network callers. Any caller who can supply a valid image ID can issue GET /api/image/{imageId}/comments or open a server-sent-events subscription and receive the full comment thread and live updates without presenting any credentials. The patch (v1.12.3) retroactively adds a Symfony AuthorizationCheckerInterface voter to both the GetCommentsByImageHandler query handler and CreateCommentHandler, introducing owner, public-guest, and collection-share access checks that were entirely absent before. No public exploit has been identified at time of analysis.
Slink v1.4.9 allows stored cross-site scripting (XSS) via crafted SVG uploads. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Missing authorization on image comment endpoints in Slink before 1.12.3 exposes comment threads to unauthenticated network callers. Any caller who can supply a valid image ID can issue GET /api/image/{imageId}/comments or open a server-sent-events subscription and receive the full comment thread and live updates without presenting any credentials. The patch (v1.12.3) retroactively adds a Symfony AuthorizationCheckerInterface voter to both the GetCommentsByImageHandler query handler and CreateCommentHandler, introducing owner, public-guest, and collection-share access checks that were entirely absent before. No public exploit has been identified at time of analysis.
Slink v1.4.9 allows stored cross-site scripting (XSS) via crafted SVG uploads. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.