Skip to content

Commit bfe5818

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-558g-h753-6m33 GHSA-5fhx-9jwj-867m GHSA-g857-hhfv-j68w GHSA-jgcf-rf45-2f8v GHSA-mpf5-3vph-q75r GHSA-mqph-7h49-hqfm GHSA-vj45-x3pj-f4w4
1 parent 37f24b3 commit bfe5818

File tree

7 files changed

+532
-0
lines changed

7 files changed

+532
-0
lines changed

‎advisories/github-reviewed/2026/04/GHSA-558g-h753-6m33/GHSA-558g-h753-6m33.json‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-558g-h753-6m33",
4+
"modified": "2026-04-16T20:41:38Z",
5+
"published": "2026-04-16T20:41:38Z",
6+
"aliases": [
7+
"CVE-2026-33435"
8+
],
9+
"summary": "Weblate: Remote code execution during backup restoration",
10+
"details": "### Impact\nThe project backup didn't filter Git and Mercurial configuration files and this could lead to remote code execution under certain circumstances.\n\n### Patches\n* https://github.com/WeblateOrg/weblate/pull/18549\n\n### Workarounds\nThe project backup is only accessible to users who can create projects. Restricting access to this limits scope of the vulnerability.\n\n### References\nThis issue was reported by [ggamno](https://hackerone.com/ggamno) via HackerOne.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "PyPI",
21+
"name": "weblate"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "5.17"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/WeblateOrg/weblate/security/advisories/GHSA-558g-h753-6m33"
42+
},
43+
{
44+
"type": "ADVISORY",
45+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33435"
46+
},
47+
{
48+
"type": "WEB",
49+
"url": "https://github.com/WeblateOrg/weblate/pull/18549"
50+
},
51+
{
52+
"type": "PACKAGE",
53+
"url": "https://github.com/WeblateOrg/weblate"
54+
}
55+
],
56+
"database_specific": {
57+
"cwe_ids": [
58+
"CWE-23",
59+
"CWE-434",
60+
"CWE-94"
61+
],
62+
"severity": "HIGH",
63+
"github_reviewed": true,
64+
"github_reviewed_at": "2026-04-16T20:41:38Z",
65+
"nvd_published_at": "2026-04-15T19:16:35Z"
66+
}
67+
}

‎advisories/github-reviewed/2026/04/GHSA-5fhx-9jwj-867m/GHSA-5fhx-9jwj-867m.json‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5fhx-9jwj-867m",
4+
"modified": "2026-04-16T20:41:59Z",
5+
"published": "2026-04-16T20:41:59Z",
6+
"aliases": [
7+
"CVE-2026-33440"
8+
],
9+
"summary": "Weblate: Authenticated SSRF via redirect bypass of ALLOWED_ASSET_DOMAINS in screenshot URL uploads",
10+
"details": "### Impact\nThe ALLOWED_ASSET_DOMAINS setting applied only to the first issued requests and didn't restrict possible redirects.\n\n### Patches\n* https://github.com/WeblateOrg/weblate/pull/18550\n\n### References\nThis issue was reported by @spbavarva via GitHub.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "PyPI",
21+
"name": "weblate"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "5.17"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/WeblateOrg/weblate/security/advisories/GHSA-5fhx-9jwj-867m"
42+
},
43+
{
44+
"type": "ADVISORY",
45+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33440"
46+
},
47+
{
48+
"type": "WEB",
49+
"url": "https://github.com/WeblateOrg/weblate/pull/18550"
50+
},
51+
{
52+
"type": "WEB",
53+
"url": "https://github.com/WeblateOrg/weblate/commit/8be80625a864c8db5854503872a65e8a0b7399a6"
54+
},
55+
{
56+
"type": "PACKAGE",
57+
"url": "https://github.com/WeblateOrg/weblate"
58+
}
59+
],
60+
"database_specific": {
61+
"cwe_ids": [
62+
"CWE-918"
63+
],
64+
"severity": "MODERATE",
65+
"github_reviewed": true,
66+
"github_reviewed_at": "2026-04-16T20:41:59Z",
67+
"nvd_published_at": "2026-04-15T19:16:35Z"
68+
}
69+
}

‎advisories/github-reviewed/2026/04/GHSA-g857-hhfv-j68w/GHSA-g857-hhfv-j68w.json‎

Lines changed: 111 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,111 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-g857-hhfv-j68w",
4+
"modified": "2026-04-16T20:40:54Z",
5+
"published": "2026-04-16T20:40:54Z",
6+
"aliases": [
7+
"CVE-2026-27820"
8+
],
9+
"summary": "Buffer Overflow in Zlib::GzipReader ungetc via large input leads to memory corruption",
10+
"details": "### Details\n\nA buffer overflow vulnerability exists in `Zlib::GzipReader`.\n\nThe `zstream_buffer_ungets` function prepends caller-provided bytes ahead of previously produced output but fails to guarantee the backing Ruby string has enough capacity before the memmove shifts the existing data. This can lead to memory corruption when the buffer length exceeds capacity.\n\n### Recommended action\n\nWe recommend to update the `zlib` gem to version 3.2.3 or later. In order to ensure compatibility with bundled version in older Ruby series, you may update as follows instead:\n\n* For Ruby 3.2 users: Update to zlib 3.0.1\n* For Ruby 3.3 users: Update to zlib 3.1.2\n\nYou can use gem update zlib to update it. If you are using bundler, please add `gem \"zlib\", \">= 3.2.3\"` to your Gemfile.\n\n### Affected versions\n\nzlib gem 3.2.2 or lower\n\n### Credits\n\n[calysteon](https://hackerone.com/calysteon)\n\n### References\n\n* https://hackerone.com/reports/3467067",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "RubyGems",
21+
"name": "zlib"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "3.2.0"
29+
},
30+
{
31+
"fixed": "3.2.3"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "RubyGems",
40+
"name": "zlib"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "3.1.0"
48+
},
49+
{
50+
"fixed": "3.1.2"
51+
}
52+
]
53+
}
54+
]
55+
},
56+
{
57+
"package": {
58+
"ecosystem": "RubyGems",
59+
"name": "zlib"
60+
},
61+
"ranges": [
62+
{
63+
"type": "ECOSYSTEM",
64+
"events": [
65+
{
66+
"introduced": "0"
67+
},
68+
{
69+
"fixed": "3.0.1"
70+
}
71+
]
72+
}
73+
]
74+
}
75+
],
76+
"references": [
77+
{
78+
"type": "WEB",
79+
"url": "https://github.com/ruby/zlib/security/advisories/GHSA-g857-hhfv-j68w"
80+
},
81+
{
82+
"type": "ADVISORY",
83+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27820"
84+
},
85+
{
86+
"type": "WEB",
87+
"url": "https://hackerone.com/reports/3467067"
88+
},
89+
{
90+
"type": "PACKAGE",
91+
"url": "https://github.com/ruby/zlib"
92+
},
93+
{
94+
"type": "WEB",
95+
"url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/zlib/CVE-2026-27820.yml"
96+
},
97+
{
98+
"type": "WEB",
99+
"url": "https://www.ruby-lang.org/en/news/2026/03/05/buffer-overflow-zlib-cve-2026-27820"
100+
}
101+
],
102+
"database_specific": {
103+
"cwe_ids": [
104+
"CWE-120"
105+
],
106+
"severity": "MODERATE",
107+
"github_reviewed": true,
108+
"github_reviewed_at": "2026-04-16T20:40:54Z",
109+
"nvd_published_at": "2026-04-16T18:16:44Z"
110+
}
111+
}

‎advisories/github-reviewed/2026/04/GHSA-jgcf-rf45-2f8v/GHSA-jgcf-rf45-2f8v.json‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-jgcf-rf45-2f8v",
4+
"modified": "2026-04-16T20:40:37Z",
5+
"published": "2026-04-16T20:40:37Z",
6+
"aliases": [
7+
"CVE-2026-24749"
8+
],
9+
"summary": "Silverstripe Assets Module has a DBFile::getURL() permission bypass",
10+
"details": "### Impact\n\nImages rendered in templates or otherwise accessed via `DBFile::getURL()` or `DBFile::getSourceURL()` incorrectly add an access grant to the current session, which bypasses file permissions.\n\nThis usually happens when creating an image variant, for example using a manipulation method like `ScaleWidth()` or `Convert()`.\n\nNote that if you use `DBFile` directly in the `$db` configuration for a `DataObject` class that doesn't subclass `File`, and if you were setting the visibility of those files to \"protected\", those files will now need an explicit access grant to be accessed. If you do not want to explicitly provide access grants for these files (i.e. you want these files to be accessible by default), you should use the \"public\" visibility.\n\n### Reported by\n\nRestruct web & apps",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Packagist",
21+
"name": "silverstripe/assets"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "2.4.5"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "Packagist",
40+
"name": "silverstripe/assets"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "3.0.0"
48+
},
49+
{
50+
"fixed": "3.1.3"
51+
}
52+
]
53+
}
54+
]
55+
}
56+
],
57+
"references": [
58+
{
59+
"type": "WEB",
60+
"url": "https://github.com/silverstripe/silverstripe-assets/security/advisories/GHSA-jgcf-rf45-2f8v"
61+
},
62+
{
63+
"type": "ADVISORY",
64+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24749"
65+
},
66+
{
67+
"type": "PACKAGE",
68+
"url": "https://github.com/silverstripe/silverstripe-assets"
69+
},
70+
{
71+
"type": "WEB",
72+
"url": "https://www.silverstripe.org/download/security-releases/cve-2026-24749"
73+
}
74+
],
75+
"database_specific": {
76+
"cwe_ids": [
77+
"CWE-266",
78+
"CWE-863"
79+
],
80+
"severity": "MODERATE",
81+
"github_reviewed": true,
82+
"github_reviewed_at": "2026-04-16T20:40:37Z",
83+
"nvd_published_at": "2026-04-16T18:16:44Z"
84+
}
85+
}

0 commit comments

Comments
 (0)