Skip to content

Commit 74a2288

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-5f7h-p83x-5vc2 GHSA-88v5-9hxc-f85r GHSA-h39g-6x3c-7fq9
1 parent ac3f426 commit 74a2288

File tree

3 files changed

+124
-12
lines changed

3 files changed

+124
-12
lines changed

advisories/unreviewed/2026/04/GHSA-5f7h-p83x-5vc2/GHSA-5f7h-p83x-5vc2.json renamed to advisories/github-reviewed/2026/04/GHSA-5f7h-p83x-5vc2/GHSA-5f7h-p83x-5vc2.json

Lines changed: 28 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-5f7h-p83x-5vc2",
4-
"modified": "2026-04-10T00:30:29Z",
4+
"modified": "2026-04-18T00:55:40Z",
55
"published": "2026-04-10T00:30:29Z",
6-
"aliases": [
7-
"CVE-2026-35624"
8-
],
9-
"details": "OpenClaw before 2026.3.22 contains a policy confusion vulnerability in room authorization that matches colliding room names instead of stable room tokens. Attackers can exploit similarly named rooms to bypass allowlist policies and gain unauthorized access to protected Nextcloud Talk rooms.",
6+
"withdrawn": "2026-04-18T00:55:40Z",
7+
"aliases": [],
8+
"summary": "Duplicate Advisory: OpenClaw: Nextcloud Talk room allowlist matched colliding room names instead of stable room tokens",
9+
"details": "## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-xhq5-45pm-2gjr. This link is maintained to preserve external references.\n\n## Original Description\nOpenClaw before 2026.3.22 contains a policy confusion vulnerability in room authorization that matches colliding room names instead of stable room tokens. Attackers can exploit similarly named rooms to bypass allowlist policies and gain unauthorized access to protected Nextcloud Talk rooms.",
1010
"severity": [
1111
{
1212
"type": "CVSS_V3",
@@ -17,7 +17,27 @@
1717
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
1818
}
1919
],
20-
"affected": [],
20+
"affected": [
21+
{
22+
"package": {
23+
"ecosystem": "npm",
24+
"name": "openclaw"
25+
},
26+
"ranges": [
27+
{
28+
"type": "ECOSYSTEM",
29+
"events": [
30+
{
31+
"introduced": "0"
32+
}
33+
]
34+
}
35+
],
36+
"database_specific": {
37+
"last_known_affected_version_range": "< 2026.3.22"
38+
}
39+
}
40+
],
2141
"references": [
2242
{
2343
"type": "WEB",
@@ -45,8 +65,8 @@
4565
"CWE-807"
4666
],
4767
"severity": "LOW",
48-
"github_reviewed": false,
49-
"github_reviewed_at": null,
68+
"github_reviewed": true,
69+
"github_reviewed_at": "2026-04-18T00:55:40Z",
5070
"nvd_published_at": "2026-04-09T22:16:30Z"
5171
}
5272
}

advisories/unreviewed/2026/04/GHSA-88v5-9hxc-f85r/GHSA-88v5-9hxc-f85r.json renamed to advisories/github-reviewed/2026/04/GHSA-88v5-9hxc-f85r/GHSA-88v5-9hxc-f85r.json

Lines changed: 29 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,40 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-88v5-9hxc-f85r",
4-
"modified": "2026-04-17T06:31:08Z",
4+
"modified": "2026-04-18T00:53:47Z",
55
"published": "2026-04-17T06:31:08Z",
66
"aliases": [
77
"CVE-2026-5807"
88
],
9+
"summary": "HashiCorp Vault Vulnerable to Denial-of-Service via Unauthenticated Root Token Generation/Rekey Operations",
910
"details": "Vault is vulnerable to a denial-of-service condition where an unauthenticated attacker can repeatedly initiate or cancel root token generation or rekey operations, occupying the single in-progress operation slot. This prevents legitimate operators from completing these workflows. This vulnerability, CVE-2026-5807, is fixed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0.",
1011
"severity": [
1112
{
1213
"type": "CVSS_V3",
1314
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
1415
}
1516
],
16-
"affected": [],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "github.com/hashicorp/vault"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"last_affected": "1.21.4"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
1738
"references": [
1839
{
1940
"type": "ADVISORY",
@@ -22,15 +43,19 @@
2243
{
2344
"type": "WEB",
2445
"url": "https://discuss.hashicorp.com/t/hcsec-2026-08-vault-vulnerable-to-denial-of-service-via-unauthenticated-root-token-generation-rekey-operations/77345"
46+
},
47+
{
48+
"type": "PACKAGE",
49+
"url": "https://github.com/hashicorp/vault"
2550
}
2651
],
2752
"database_specific": {
2853
"cwe_ids": [
2954
"CWE-770"
3055
],
3156
"severity": "HIGH",
32-
"github_reviewed": false,
33-
"github_reviewed_at": null,
57+
"github_reviewed": true,
58+
"github_reviewed_at": "2026-04-18T00:53:47Z",
3459
"nvd_published_at": "2026-04-17T05:16:19Z"
3560
}
3661
}

‎advisories/github-reviewed/2026/04/GHSA-h39g-6x3c-7fq9/GHSA-h39g-6x3c-7fq9.json‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-h39g-6x3c-7fq9",
4+
"modified": "2026-04-18T00:55:19Z",
5+
"published": "2026-04-18T00:55:19Z",
6+
"aliases": [],
7+
"summary": "Zio has SubFileSystem Path Confinement Bypass via Unresolved `..` Segment",
8+
"details": "# Summary\n\n`SubFileSystem` fails to confine operations to its declared sub path when the input path is `/../` (or equivalents `/../`, `/..\\\\`). This path passes all validation but resolves to the root of the parent filesystem, allowing directory level operations outside the intended boundary.\n\n# Affected Component\n\n`Zio.UPath.ValidateAndNormalize`\n`Zio.FileSystems.SubFileSystem`\n\n`UPath.ValidateAndNormalize` has a trailing slash optimisation.\n\n```csharp\nif (!processParts && i + 1 == path.Length)\n return path.Substring(0, path.Length - 1);\n```\n\nWhen the input ends with `/` or `\\`, and `processParts` is still false, the function strips the trailing separator and returns immediately before the `..` resolution logic runs. The input `/../` triggers this path: the trailing `/` is the last character, `processParts` has not been set (because `..` as the first relative segment after root is specifically exempted), so the function returns `/..` with the `..` segment unresolved.\n\nThe resulting `UPath` with `FullName = \"/..\"` is absolute, contains no control characters, and no colon so it passes `FileSystem.ValidatePath` without rejection.\n\nWhen this path reaches `SubFileSystem.ConvertPathToDelegate`:\n\n```csharp\nprotected override UPath ConvertPathToDelegate(UPath path)\n{\n var safePath = path.ToRelative(); // \"/..\".ToRelative() = \"..\"\n return SubPath / safePath; // \"/jail\" / \"..\" = \"/\" (resolved by Combine)\n}\n```\n\nThe delegate filesystem receives `/` (the root) instead of a path under `/jail`.\n\n# Proof of Concept\n\n```csharp\nusing Zio;\nusing Zio.FileSystems;\n\nvar root = new MemoryFileSystem();\nroot.CreateDirectory(\"/sandbox\");\nvar sub = new SubFileSystem(root, \"/sandbox\");\n\nConsole.WriteLine(sub.DirectoryExists(\"/../\")); // True (sees parent root)\nConsole.WriteLine(sub.ConvertPathToInternal(\"/../\")); // \"/\" (parent root path)\n```\n\n# Impact\n\nThe escape is limited to directory level operations because appending a filename after `..` (e.g., `/../file.txt`) causes normal `..` resolution to trigger, which correctly rejects the path as going above root. Only the bare terminal `/../` (which strips to `/..`) survives. This means that exploitability is limited, and this vulnerability does not escalate to file read/write.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V3",
12+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "NuGet",
19+
"name": "Zio"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
},
28+
{
29+
"fixed": "0.22.2"
30+
}
31+
]
32+
}
33+
],
34+
"database_specific": {
35+
"last_known_affected_version_range": "<= 0.22.1"
36+
}
37+
}
38+
],
39+
"references": [
40+
{
41+
"type": "WEB",
42+
"url": "https://github.com/xoofx/zio/security/advisories/GHSA-h39g-6x3c-7fq9"
43+
},
44+
{
45+
"type": "WEB",
46+
"url": "https://github.com/xoofx/zio/commit/c8c2f5328e50c1e7ab8c5c405fe70e0bd35f4782"
47+
},
48+
{
49+
"type": "PACKAGE",
50+
"url": "https://github.com/xoofx/zio"
51+
},
52+
{
53+
"type": "WEB",
54+
"url": "https://github.com/xoofx/zio/releases/tag/0.22.2"
55+
}
56+
],
57+
"database_specific": {
58+
"cwe_ids": [
59+
"CWE-179",
60+
"CWE-22"
61+
],
62+
"severity": "LOW",
63+
"github_reviewed": true,
64+
"github_reviewed_at": "2026-04-18T00:55:19Z",
65+
"nvd_published_at": null
66+
}
67+
}

0 commit comments

Comments
 (0)