Advisory Catalog

Grav: config_denied_paths default list omits `system`, exposing real secrets (e.g. system.cache.redis.password) via the Twig sandbox when config_access is enabled

Grav: UserInterface offsetget/offsetexists allow-listed in Twig sandbox let editor-authored content leak hashed_password and 2FA secrets via offsetGet()

Grav: The system, site, and theme Twig variables bypass the content sandbox entirely and are never covered by config_denied_paths

Grav: media_directory() Twig function allows filesystem path traversal and file content disclosure from sandboxed page content

Grav: Path Traversal in MediaUploadTrait::deleteFile() Allows Arbitrary File Deletion

CakePHP: SmtpTransport vulnerable to CRLF header injection

Filament: Multi-factor authentication (app) can be bypassed when recovery codes are enabled

YOURLS has stored XSS in referrer statistics chart via crafted Referer header

Winter: ImportExportController AJAX handlers bypass granular import/export permission gate

Laravel Backpack CRUD: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)

Laravel Backpack CRUD: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR)

Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk

Laravel Backpack CRUD: Unverified password change in MyAccountController via mass assignment

MCP PHP SDK: client HttpTransport SSE buffer (sseBuffer .= chunk) grows unbounded when server withholds the event delimiter

Snipe-IT: Chained Information Disclosure and IDOR Leads to Full EULA File Takeover

Snipe-IT: Tenant Isolation Bypass in FMCS Floater Mode

Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData()

Grav: .htaccess file extension rules bypass via case variation on case-insensitive filesystems

Grav: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pending Challenge

LibreNMS Vulnerable to Remote Code Execution via AboutController

Froxlor: Second-Order SQL Injection via `Admins.add` `ipaddress` Parameter Allows Full Database Exfiltration

Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeover

MineAdmin Vulnerable to Path Traversal via Unsanitized identifier in Plugin Install/Uninstall

LibreNMS Vulnerable to Remote Code Execution by Signal Alert Transportation module

Grav: Unauthenticated Path Traversal via Missing Directory-Boundary Check in `plugin-asset-map.php` Static Asset Server (`index.php`)

Grav CMS vulnerable to remote code execution via .zip file upload

Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name

Winter: Authenticated backend users can bypass Users controller permission checks

Winter: Stored XSS through Editor Settings custom styles

Winter: Stored XSS through Brand Settings custom styles

TYPO3 CMS - Broken Access Control in Backend and Install Tool

Craft CMS: Arbitrary file read via SplFileObject in non-sandboxed template contexts

Craft CMS: Authenticated leak of secret environment variables

PHP_CodeSniffer gitblame report command injection via crafted filename

Craft CMS: Arbitrary user password reset leading to administrator account takeover

Craft CMS: Authenticated RCE through Twig sandbox escape

Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass

league/commonmark: Denial of service via colliding heading slugs

league/commonmark: Denial of service via duplicate footnote definitions

league/commonmark: Denial of service via adjacent inline attribute blocks

league/commonmark: Quadratic-time denial of service when parsing crafted Markdown

Statamic: Account takeover via OAuth email matching without email-verification check

Guzzle: Noncanonical host can bypass host-based checks

Grav: Path Traversal in ImageMedium::watermark() — arbitrary file disclosure via publicly-cached images

Grav: Incomplete callable validation in blueprint dynamic fields allows arbitrary static method invocation and file disclosure

Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod_php multi-extension handlers

CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames

Sylius Mollie Plugin vulnerable to payment status forgery via the payment webhook

Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions

Pterodactyl's shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authentication lockout (DoS)